Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-64665

  CVE-2026-64665: Statamic CMS OAuth Account Takeover via Unverified Email Matching

  A Statamic site using OAuth login can be broken into by anyone who registers with a third-party provider using the same email address as an existing account, letting an attacker walk in as that user…

• criticalCVE-2026-65600

  CVE-2026-65600: Traefik ReplacePathRegex Authentication Bypass via Path Traversal

  A flaw in Traefik's ReplacePathRegex middleware lets an attacker reach password-protected routes with a single crafted request, bypassing BasicAuth, ForwardAuth, or DigestAuth entirely.

• highCVE-2026-54763

  CVE-2026-54763: Traefik BasicAuth/DigestAuth/ForwardAuth Underscore Header Identity Spoofing

  Attackers can inject an underscore-variant HTTP header (e.g. X_Auth_User) that bypasses Traefik's identity-header stripping and reaches the backend with a spoofed user value, defeating BasicAuth…

• highCVE-2026-71327

  CVE-2026-71327: Traefik Gateway API Route Identity Collision Allows Cross-Namespace Backend Hijacking

  Traefik's Kubernetes Gateway API provider builds route identifiers by joining namespace and name with hyphens, so two routes whose names contain hyphens can produce the same key, letting a tenant…

• highCVE-2026-67309

  CVE-2026-67309: Traefik Kubernetes Ingress NGINX RewriteTarget Path Traversal Authentication Bypass

  A path traversal flaw in Traefik's Kubernetes Ingress NGINX provider lets an unauthenticated attacker reach protected routes by sending a single crafted HTTP request that bypasses route-level…

• highCVE-2026-71324

  CVE-2026-71324: Traefik HTTP/2 CONNECT Pool Poisoning Cross-User Response Smuggling

  Traefik lets an unauthenticated attacker smuggle a raw HTTP request inside an HTTP/2 or HTTP/3 CONNECT body, poisoning the shared backend connection pool so a different user receives the attacker's…

• highCVE-2026-71321

  CVE-2026-71321: Nuxt Island Endpoint Unauthenticated CPU Exhaustion (DoS)

  Any anonymous attacker can stall a Nuxt server by sending a large JSON body to the island renderer endpoint, which parses and hashes the input before checking whether the request is even valid.

• highCVE-2026-71316

  CVE-2026-71316: Nuxt SSR Payload Cache Cross-User Information Disclosure

  Nuxt 4.x cached pages stored each user's SSR data in a shared server-side cache keyed only by URL path, letting any visitor fetch another user's private page data with a plain HTTP GET.

• highCVE-2026-71314

  CVE-2026-71314: Nuxt Unauthenticated DoS via Unbounded v-for Expansion in Island Rendering

  Any Nuxt app using server components or islands can be crashed by a single unauthenticated HTTP request that passes a huge integer as a prop, causing the server to expand a v-for loop to millions of…

• highCVE-2026-71315

  CVE-2026-71315: Nuxt appMiddleware Auth Bypass via Mixed-Case Route Rule Keys

  Nuxt apps that protect pages with appMiddleware via routeRules are left completely unguarded if any route rule key contains an uppercase letter, because an incomplete earlier fix lowercased only the…

• highCVE-2026-71312

  CVE-2026-71312: rclone SFTP PowerShell Smart-Quote Filename OS Command Injection

  A crafted filename containing a Unicode smart quote can break out of rclone's PowerShell path quoting on SFTP remotes and execute arbitrary commands as the victim's SSH account.

• highCVE-2026-59733

  CVE-2026-59733: rclone serve restic --private-repos Authorization Bypass via Path Traversal

  An authenticated user of a multi-tenant rclone restic server can read, overwrite, or delete any other user's backup repository by slipping a dot-dot segment into the URL, defeating the per-user…