Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- criticalCVE-2026-59151
CVE-2026-59151: Prowler SAML Cross-Tenant Account Takeover
Prowler's SAML login flow trusted the email address inside an attacker-signed SAMLResponse to decide which tenant to issue a token for, letting any authenticated user with their own SAML IdP hijack…
- highCVE-2026-56827
CVE-2026-56827: Shopper Framework Missing Authorization on Filament Bulk Actions
Browse-only staff accounts in Shopper's admin panel can mass-delete product attributes and tags, or toggle brand, category, and supplier visibility in bulk, because five Filament grouped bulk actions…
- criticalCVE-2026-59971
CVE-2026-59971: mysql-mcp-server Unauthenticated SQL Execution via Missing Origin and Host Validation
When mysql-mcp-server runs in SSE mode, any network attacker or malicious website can execute arbitrary SQL queries against the configured MySQL database with no credentials required, because the…
- criticalCVE-2026-11746
CVE-2026-11746: Central Dogma Hard-coded ZooKeeper Replication Secret Enables Cluster Takeover
Central Dogma silently falls back to a well-known hard-coded password when operators omit the ZooKeeper replication secret, letting any attacker with network access read the full replication log or…
- highCVE-2026-11745
CVE-2026-11745: centraldogma-server-mirror-git SSH Host Key Verification Bypass
Central Dogma's Git-over-SSH mirror client blindly trusts any host key presented by a remote server, letting any attacker on the same network impersonate the upstream Git host and inject malicious…
- highCVE-2026-88009
CVE-2026-88009: Traefik HTTP Request Smuggling via Rootless Opaque Request-Target
Sending an HTTP/1.1 request with a rootless opaque target like 'GET http:http://internal-vhost/admin HTTP/1.1' tricks Traefik into routing and logging the request as '/' while forwarding the…
- criticalCVE-2026-88007
CVE-2026-88007: Traefik HTTP/3 NTLM Backend Connection Reuse
Traefik's HTTP/3 entrypoint fails to isolate per-client backend connections for NTLM or Kerberos authentication, letting an unauthenticated attacker inherit a victim's already-authenticated backend…
- highCVE-2026-88004
CVE-2026-88004: Traefik Entrypoint Header Sanitization Bypass via HTTP Trailers
Traefik's defenses against spoofed trusted header names only scan HTTP headers, not trailers, so an attacker can smuggle a banned name like X_Auth_User or X-Forwarded-Prefix as a chunked trailer and…
- highCVE-2026-88008
CVE-2026-88008: Traefik h2c Upgrade Middleware Bypass via HTTP Request Smuggling
Traefik forwarded client-supplied h2c upgrade headers to backends without restriction, allowing an attacker to open a raw HTTP/2 tunnel through an unprotected route and silently bypass authentication…
- highCVE-2026-59960
CVE-2026-59960: @argos-ci/core CI Branch Name OS Command Injection
A crafted CI branch name containing shell metacharacters can execute arbitrary commands on the CI runner because @argos-ci/core passes the branch string directly into a shell-interpreted execSync()…
- highCVE-2026-87011
CVE-2026-87011: open-webui OIDC Back-Channel Logout Unauthenticated DoS
Anyone who can reach an Open WebUI instance with OIDC back-channel logout enabled can stall the server completely by flooding a public endpoint with forged logout tokens, forcing two uncached network…
- criticalCVE-2026-88018
CVE-2026-88018: rclone serve s3 SigV4 Authentication Bypass via Empty Secret
Any unauthenticated attacker can sign an S3 request with an empty secret and be accepted as a fully authenticated user by rclone's serve s3 when --auth-proxy is used without --auth-key.