Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-61534

  CVE-2026-61534: yayson Prototype Pollution via JSON:API Type Deserialization

  The yayson JSON:API client lets an attacker send a crafted document whose resource type is '__proto__', silently writing arbitrary properties onto every object in the Node.js process.

• highCVE-2026-59973

  CVE-2026-59973: mcp-from-openapi OpenAPI $ref SSRF Filter Bypass

  The SSRF hostname denylist added in mcp-from-openapi 2.3.0 can be bypassed using DNS names that resolve to loopback, HTTP redirects, or IPv4-mapped IPv6 addresses, letting an attacker reach internal…

• highCVE-2026-59148

  CVE-2026-59148: @mockoon/commons-server Unauthenticated Admin API + Wildcard CORS

  Mockoon's built-in admin API had no authentication and replied with Access-Control-Allow-Origin: * on every endpoint, letting anyone who could reach the mock server port, including a malicious…

• highCVE-2026-56828

  CVE-2026-56828: shopper/framework Privilege Escalation via Livewire Misconfigured Authorization

  A staff user with only read-level access to the Shopper admin panel can grant themselves full admin permissions, create new admin accounts, or delete roles, because three Livewire components guard…

• highCVE-2026-56829

  CVE-2026-56829: Shopper VariantStock Missing Authorization

  Any logged-in Shopper admin panel user, even one with read-only permissions, can silently adjust inventory levels for any product variant in the database by tampering with a single unprotected…

• highCVE-2026-56825

  CVE-2026-56825: Shopper CollectionProducts Missing Authorization

  Any logged-in admin panel user, even one with read-only access, can silently remove all products from any collection in the store by forging a Livewire wire payload, because the CollectionProducts…

• criticalCVE-2026-59151

  CVE-2026-59151: Prowler SAML Cross-Tenant Account Takeover

  Prowler's SAML login flow trusted the email address inside an attacker-signed SAMLResponse to decide which tenant to issue a token for, letting any authenticated user with their own SAML IdP hijack…

• highCVE-2026-56827

  CVE-2026-56827: Shopper Framework Missing Authorization on Filament Bulk Actions

  Browse-only staff accounts in Shopper's admin panel can mass-delete product attributes and tags, or toggle brand, category, and supplier visibility in bulk, because five Filament grouped bulk actions…

• criticalCVE-2026-59971

  CVE-2026-59971: mysql-mcp-server Unauthenticated SQL Execution via Missing Origin and Host Validation

  When mysql-mcp-server runs in SSE mode, any network attacker or malicious website can execute arbitrary SQL queries against the configured MySQL database with no credentials required, because the…

• criticalCVE-2026-11746

  CVE-2026-11746: Central Dogma Hard-coded ZooKeeper Replication Secret Enables Cluster Takeover

  Central Dogma silently falls back to a well-known hard-coded password when operators omit the ZooKeeper replication secret, letting any attacker with network access read the full replication log or…

• highCVE-2026-11745

  CVE-2026-11745: centraldogma-server-mirror-git SSH Host Key Verification Bypass

  Central Dogma's Git-over-SSH mirror client blindly trusts any host key presented by a remote server, letting any attacker on the same network impersonate the upstream Git host and inject malicious…

• highCVE-2026-88009

  CVE-2026-88009: Traefik HTTP Request Smuggling via Rootless Opaque Request-Target

  Sending an HTTP/1.1 request with a rootless opaque target like 'GET http:http://internal-vhost/admin HTTP/1.1' tricks Traefik into routing and logging the request as '/' while forwarding the…