https://spaceraccoon.github.io/vulnerability-spoiler-alert AI-powered early warning for open-source security patches — before the CVE drops. en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/673 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/673 Thu, 27 Aug 2026 01:00:12 GMT The Buzz bus checked sender membership before queuing/deduplication but did not re-verify membership after asynchronous admission. A sender removed from a room could still have a queued or in-flight message processed, allowing unauthorized command execution. The patch adds revalidation after queued/dedupe work and after async ingress, rejecting revoked senders. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/674 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/674 Thu, 27 Aug 2026 01:01:39 GMT Before the patch, harness-injected user-role messages from Claude Code (e.g., skill instruction bodies, compaction summaries) were rendered in webchat as right-aligned operator bubbles, making attacker-controlled content appear as if typed by the operator. This allowed an attacker who could influence a skill's content or the transcript to spoof operator messages, potentially tricking the operator into taking unintended actions. The patch records provenance for these messages and renders them as collapsed 'Injected context' notices instead of operator turns. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/676 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/676 Thu, 27 Aug 2026 01:09:51 GMT The LibraryPanel update handler passed the existing object to UpdatedObject without deep copying, allowing an in-place PATCH transformer to mutate its folder UID before authorization. A user with read-only access to a library panel's source folder but create access to a different folder could move the panel by changing the folder in the patch, bypassing source folder update permission. The patch uses DeepCopyObject to keep the original object immutable so source-folder authorization cannot be bypassed. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/675 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/675 Thu, 27 Aug 2026 01:08:05 GMT Before this patch, OpenAI-compatible providers with missing or empty baseUrl would fall back to the OpenAI SDK default endpoint (api.openai.com). This could cause API keys and sensitive request data intended for a third-party provider (e.g., OpenRouter) to be sent to OpenAI's servers, leading to credential leakage and potential unauthorized usage. The patch enforces that non-OpenAI providers must supply an explicit base URL, failing closed otherwise. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/672 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/672 Wed, 26 Aug 2026 21:26:42 GMT Before the patch, compaction prompts for sessions with a finite toolsAllow policy still included the full set of effective tools and private skill guidance. An attacker with a restricted session could trigger manual, recovery, or after-turn compaction and use prompt injection to make the model reveal this hidden information. The patch filters the prompt tools to the allowed list and suppresses private skills when the tool policy is restricted. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/669 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/669 Wed, 26 Aug 2026 18:55:11 GMT Role-required sandboxes were scoped per agent instead of per authenticated principal. Multiple guests sharing the same agent received the same sandbox container and workspace, allowing one guest to read or modify another guest's files. The patch qualifies sandbox identity with the session creator's principal and caps workspaceAccess from 'rw' to 'ro' for role-required sessions, preventing cross-guest data access. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/670 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/670 Wed, 26 Aug 2026 18:57:50 GMT The read tool appended base64 image data to the tool result even when the model did not support vision, contradicting the omission note and causing massive unnecessary context consumption. An attacker who can influence the agent to read a large image file could exhaust the context window and kill the session. The patch drops the image payload when the model lacks vision capability. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/671 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/671 Wed, 26 Aug 2026 18:59:32 GMT The ACP live reply projector did not apply the verified conversation context sanitizer to streamed text deltas. If an agent echoed marked private inbound context (e.g., current message or history markers) across multiple streaming deltas, that private content was delivered directly or routed to another channel, leaking internal prompt scaffolding and private conversation data. The patch introduces a stream filter that accumulates deltas and only releases newly confirmed-safe text, preventing such leaks. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/668 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/668 Wed, 26 Aug 2026 17:01:31 GMT Before this patch, GroupPolicyProvider matched a bare group name from the token claim (e.g., 'Admins') against any allowed group's name, regardless of the group's position in the hierarchy. This allowed a user who was a member of a nested group with the same name as a different group to satisfy group-based authorization policies. The patch resolves bare names to top-level groups first and compares their IDs, falling back to full path matching only when no top-level group matches. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/667 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/667 Wed, 26 Aug 2026 16:59:20 GMT The file-transfer plugin previously remembered approvals based only on the requested path, without binding them to the resolved canonical path. An attacker who could alter a symlink at an approved path could redirect subsequent transfers to arbitrary files, bypassing the operator's approval and leading to unauthorized file read/write. The patch introduces exact grants that store both requested and canonical paths and requires migration of legacy rules. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/663 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/663 Wed, 26 Aug 2026 16:13:53 GMT Before this patch, when a subagent completed while its requester session was idle, the wake message could be dispatched through the most recently activated Gateway context instead of the original owning Gateway. An attacker with a different Gateway could activate it and cause the victim's subagent completion to be routed into the attacker's session, leaking the victim's data or allowing the attacker to continue the victim's workflow. The patch fixes this by carrying the exact Gateway lifecycle resolver with each run and failing closed if that resolver is missing or retired. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/664 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/664 Wed, 26 Aug 2026 16:18:51 GMT The JWT Authorization Grant flow did not verify user consent before issuing tokens, allowing clients configured with 'consent required' to obtain access tokens with scopes the user never approved. The patch adds a call to TokenManager.verifyConsentStillAvailable before granting tokens. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/665 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/665 Wed, 26 Aug 2026 16:21:19 GMT Before the patch, OIDCRedirectUriBuilder did not remove OIDC-specific parameters (e.g., code, state, id_token) from the client-supplied redirect_uri query string or fragment. An attacker who can influence the redirect_uri (e.g., via wildcard registered redirect patterns) could inject reserved parameters, causing duplicate response parameters in the final redirect. Clients that use the first occurrence of a parameter would then process attacker-controlled values, leading to authorization code injection and account confusion. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/666 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/666 Wed, 26 Aug 2026 16:22:41 GMT Prior to the patch, Keycloak authorization codes were not cryptographically bound to the client they were issued for. An attacker could obtain an authorization code for one client, modify the client UUID embedded in the code to match a different client, and redeem it to obtain tokens for that client. The patch adds the client UUID to the code record and verifies it during parsing to prevent such retargeting. high confirmed CVE-2026-16089 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/661 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/661 Wed, 26 Aug 2026 15:01:33 GMT Before the patch, gateway-owned code ran git commands against untrusted user checkouts without pinning core.hooksPath and core.fsmonitor. A malicious repository could set core.fsmonitor (or core.hooksPath) to an arbitrary executable, causing the Gateway process to execute that command during session-diff baseline capture or worker workspace operations. The patch exports gitEnvironment() and applies -c core.fsmonitor=false / core.hooksPath=/dev/null to all remaining direct git invocations. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/662 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/662 Wed, 26 Aug 2026 15:02:55 GMT Spawned child agents (visible and hidden) did not inherit the parent session's permission policy (read-only, guarded, workspace, or Full Access), causing them to run with default permissions and potentially escalate beyond the parent's allowed scope. The patch propagates sessionPermissionPolicy through spawn paths and sets permissionMode/sessionRoot on child sessions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/660 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/660 Wed, 26 Aug 2026 14:13:17 GMT The pre-patch ChatGPT Responses stream error handling logged provider-controlled error messages, which could contain user prompt data or system prompts, to transport logs. Attackers could craft prompts that cause the provider to echo sensitive input in error responses, resulting in data leakage through logs. The patch sanitizes logging to only include fixed local fields (timing, stop reason, failure category) and never provider text. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/658 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/658 Wed, 26 Aug 2026 13:36:23 GMT The vulnerable code resolved the authoritative agent owner of a session only at broadcast time, after any debounce/queue delay. If the session's compatibility owner changed in the interim, an unqualified session key could be resolved to the new owner, causing a queued session-change event from the previous owner to be broadcast to the new owner's subscribers, leaking session metadata/content across agent boundaries. The patch captures the owner scope when the event is emitted and uses that scope for row lookup, subscription keys, and the final broadcast. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/659 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/659 Wed, 26 Aug 2026 13:43:46 GMT The patch fixes a vulnerability where client-type property constraints could be bypassed for fullScopeAllowed, nodeReRegistrationTimeout, and authorizationServicesEnabled. Attackers with permission to create or update clients could set fullScopeAllowed=true even when the client type disallows it, allowing the client to request arbitrary scopes (including sensitive admin scopes) and escalate privileges. The fix enforces these constraints at the model layer by overriding the corresponding methods in TypeAwareClientModelDelegate and adding REST-layer checks for authorizationServicesEnabled. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/657 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/657 Wed, 26 Aug 2026 12:26:27 GMT The SAML ECP SOAP endpoint returned exception details in the SOAP fault detail element, which could include sensitive information such as client IDs or internal error reasons. Attackers could craft ECP AuthnRequests with candidate Issuer values and observe different fault details to enumerate valid client IDs or gain insight into the authentication flow. The patch replaces detailed error messages with a generic fault and logs the original exception server-side. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/656 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/656 Wed, 26 Aug 2026 12:23:01 GMT Before the patch, after a browser action or navigation invalidated the selected raw target, route code inferred a replacement tab from URL matches, newly listed tabs, or the sole surviving tab. This allowed an attacker-controlled page to become the replacement target, causing subsequent Playwright actions to execute on the attacker's page instead of the intended tab, potentially leaking sensitive data or performing unauthorized actions. The patch adds ownership checks (captureOperationTarget, assertPageCurrent) to ensure the exact tab and extension connection remain valid before each action. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/654 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/654 Wed, 26 Aug 2026 10:03:33 GMT Before the patch, Gmail hook pushes were processed with a fixed 256 KiB body cap and only the first message in a batched Pub/Sub push was handled. An attacker could send multiple large emails to the victim's inbox, causing a single batched push exceeding 256 KiB. The gateway would respond with 413, which gog treats as delivery failure, rewinding the history cursor and redelivering the same batch indefinitely. This created a permanent poison-message wedge that blocked all inbound mail processing (availability impact). The patch adds per-message fan-out and derives a larger, bounded body limit for Gmail paths (capped at 32 MiB), preventing the endless retry loop. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/649 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/649 Wed, 26 Aug 2026 08:38:34 GMT The bot activation check used a case-insensitive substring match for '@botname', causing the bot to respond to messages addressed to other users whose usernames contain the bot's name as a prefix (e.g., '@botname2'). This bypasses the requireMention authorization and can lead to unintended information disclosure or command execution in group chats. The patch anchors the match to username boundaries, preventing false positives. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/650 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/650 Wed, 26 Aug 2026 08:40:33 GMT The cron job failure alert fallback could deliver sensitive failure messages to an attacker-controlled conversation by inheriting a previously active delivery context from the agent's recent interactions. The patch prevents untargeted alerts from using the origin delivery context, ensuring they are delivered only to the owning session or default owner. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/651 Wed, 26 Aug 2026 08:41:27 GMT Before the patch, Git commands executed during worktree operations (create, remove, restore, GC) in user repositories could run repository-configured hooks (e.g., post-checkout, reference-transaction) and filesystem monitors. An attacker who controls a repository processed by the service could inject malicious scripts that execute with the service's privileges, leading to arbitrary code execution. The patch prevents this by forcing core.hooksPath=/dev/null and core.fsmonitor=false via environment variables for all Git commands in the worktrees service. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/652 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/652 Wed, 26 Aug 2026 08:45:32 GMT Before the patch, the Windows Startup fallback passed the script path as a direct argument to cmd.exe via Node's spawn. If the path contained shell metacharacters but no spaces, Node did not quote it, allowing cmd to interpret the metacharacters as command separators. An attacker who could influence the scriptPath could inject arbitrary commands executed with the daemon's privileges. The patch fixes this by using an environment variable expansion inside a quoted cmd argument with windowsVerbatimArguments, preventing the path from being parsed as a command. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/653 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/653 Wed, 26 Aug 2026 08:50:19 GMT The onboarding flow initialized the location capability as enabled if the Android OS location permission was granted, ignoring the user's previously saved in-app 'Off' setting. This allowed a malicious gateway to receive location data even when the user had explicitly disabled location sharing in the app. The patch combines the saved location mode with the current Android permission, preserving the user's opt-out until explicitly re-enabled. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/647 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/647 Wed, 26 Aug 2026 07:59:37 GMT Before the patch, sandbox exec paths passed environment values as command-line arguments (Docker `--env`, SSH remote commands prefixed with `env`), exposing secrets like API keys and tokens in local process listings. The patch routes environment values through private env files or staged scripts, keeping them out of argv. This prevents local users from reading credentials via tools such as `ps` or `/proc` inspection. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/648 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/648 Wed, 26 Aug 2026 08:03:34 GMT Before the patch, NodeInvokeStreamController.sendInput did not check if the pending node invocation had passed its absolute deadline before forwarding input to the remote node. An attacker who can delay the hard-timeout callback (e.g., by blocking the event loop) could continue sending privileged input after the deadline, causing the remote command to execute actions beyond its authorized time window. The patch adds a settleIfExpired check before sending input, immediately rejecting expired invokes. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/646 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/646 Wed, 26 Aug 2026 07:18:52 GMT The user-facing reply sanitizer did not remove copies of the private prompt context (conversation history and system scaffolding) from final or streamed replies. An attacker could induce the model to echo its prompt context, leaking private user messages and internal metadata to external channels like Telegram. The patch adds exact-match redaction of conversationContext before delivery. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/645 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/645 Wed, 26 Aug 2026 06:26:27 GMT Before the patch, the webhooks plugin's cancel_flow action accepted arbitrary childSessionKey and runId values and passed them to the ACP session manager without verifying that the child session was owned by the route's configured session. An attacker with a valid webhook route secret could cancel active turns in unrelated sessions, causing denial of service and unauthorized control over other users' tasks. The patch adds ownership and run-instance validation (expectedOwnerKey, expectedRunId, expectedInstanceId) so only owner-matched canonical tasks can cancel the exact active run. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/644 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/644 Wed, 26 Aug 2026 06:03:30 GMT The Keycloak `show-config` command printed the actual plaintext values of SPI options, including secrets such as vault passwords, database passwords, or custom provider credentials. Any local user with the ability to run the CLI could retrieve these secrets, leading to potential privilege escalation or further system compromise. The patch masks all SPI option values in `show-config` output to prevent this sensitive data exposure. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/642 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/642 Wed, 26 Aug 2026 05:58:27 GMT Prior to this patch, skill dependency installers using kind: 'download' fetched archives over the network and extracted them without verifying any cryptographic hash. An attacker capable of modifying the archive in transit (e.g., man-in-the-middle on HTTP or compromise of the hosting server) could inject malicious executables or scripts into the skill's tools directory. These files would later be executed by the agent when it uses the skill, leading to arbitrary code execution. The patch adds an optional sha256 field to the download spec and verifies the downloaded archive's digest before extraction, rejecting mismatches. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/643 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/643 Wed, 26 Aug 2026 05:59:19 GMT Before the patch, already-created session tools retained the Gateway permission configuration they were constructed with. When runtime permissions were revoked (e.g., session visibility changed to 'self' or agent-to-agent messaging disabled), those tools continued using the stale configuration, allowing unauthorized session listing, history access, and message sending across agents. The patch marks config provenance as 'runtime' vs 'pinned'; runtime tools now pass undefined config so they perform execution-time policy lookups, while pinned overrides remain fixed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/640 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/640 Wed, 26 Aug 2026 05:22:37 GMT Before the patch, media reference loading in image, music, and video generation tools did not consistently enforce byte limits. Music and video tools bypassed maxBytes for inline data URLs and fetched media, and image tool allowed non-finite configured limits, enabling an attacker to trigger decoding of arbitrarily large media payloads, causing memory exhaustion and denial of service. The patch makes a mandatory resolved per-kind byte cap applied to all reference loading paths. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/641 Wed, 26 Aug 2026 05:24:25 GMT Before the patch, runtime plugin installation error messages could include the full npm registry URL with embedded credentials (user:token) and ANSI escape sequences. These unredacted errors were returned to callers and displayed/logged, potentially exposing registry tokens to anyone who can view terminal output or shared logs. The patch sanitizes the failure messages to redact credentials and strip control characters. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/639 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/639 Wed, 26 Aug 2026 04:54:19 GMT Before the patch, several Gateway session projection paths could expose a session's persisted goal to unscoped subscribers. For a global session owned by an agent, a transcript or session event without an agentId would still include session.goal from the persisted owner, allowing any connection subscribed to the global session to read the owner's private objective. The patch centralizes snapshot construction in buildGatewaySessionSnapshot and explicitly omits scoped fields like goal unless the caller provides the owner agentId. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/636 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/636 Wed, 26 Aug 2026 04:08:38 GMT Before the patch, delayed TUI command handlers for local goals, usage cost, and new session creation were not bound to the session incarnation that initiated them. If a user switched agents or sessions before an asynchronous operation resolved, stale results (such as a private continuation prompt from a previous agent) could be sent or displayed in the newly selected session, leaking private model, runtime, goal, usage, and conversation history across session boundaries. The patch captures a session incarnation and checks `isCurrent()` before applying any delayed side effects. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/637 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/637 Wed, 26 Aug 2026 04:10:21 GMT The public `agentCommandFromIngress` SDK helper accepted a caller-supplied `senderIsOwner` flag, allowing untrusted workspace plugins to impersonate the owner and access owner-only agent tools/commands. The patch forces `senderIsOwner: false` in `sanitizePublicAgentCommandIngressOpts` and binds owner authority to a trusted host-injected runtime channel capability, preventing forged owner claims from public ingress. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/638 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/638 Wed, 26 Aug 2026 04:14:28 GMT Before the patch, when a queued WebChat reply completed after its original chat request had terminalized, the follow-up delivery logic would fall back to the latest same-session dispatcher (defaults.opts?.onBlockReply), which could originate from a different source/channel. This could deliver the WebChat reply to an unintended destination, leaking conversation content across channels. The fix binds each queued reply batch to its originating Gateway admission and authoritative channel via queuedFollowupReplyDisposition, preventing cross-source delivery. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/630 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/630 Wed, 26 Aug 2026 02:13:18 GMT Android onboarding incorrectly treated notification listener access as consent to forward notifications, overriding the user's explicit opt-out. This could silently re-enable forwarding and send notification titles and message content to the gateway without user consent. The patch preserves the existing forwarding preference by requiring both listener access and prior user consent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/631 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/631 Wed, 26 Aug 2026 02:15:38 GMT The reusable exec approval mechanism previously bound approvals to the command and arguments only, omitting the working directory. An attacker could cause a command previously approved in a safe directory to execute with the same arguments from a different directory, resulting in unauthorized file access or deletion. The patch includes the canonical working directory in the approval hash and revalidates directory identity before execution. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/632 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/632 Wed, 26 Aug 2026 02:18:33 GMT Before the patch, the trusted-proxy reconnect fast path used a stale paired-device snapshot to determine the session's scopes. If an administrator revoked the device, replaced its key, or reduced its scopes concurrently with a reconnect, the Gateway could still issue a session with the old authority, allowing a revoked or restricted device to retain access. The patch rereads the authoritative paired row as the last await before returning, causing such reconnects to fail closed into the pairing lane. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/633 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/633 Wed, 26 Aug 2026 02:20:51 GMT The snapshot completion handler only validated the request UUID and not the originating WebView, document resource, or load generation. An asynchronous snapshot taken for one document could complete after the WebView navigated to a replacement document (e.g., after a Gateway route/TLS change or reset), causing the stale completion to copy or save an image of the replacement document. The patch binds each snapshot to its exact request, generation, resource, and WebView instance, invalidating ownership on any change. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/634 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/634 Wed, 26 Aug 2026 02:21:33 GMT The Crabbox worker provider previously passed setup environment secrets directly in the child process environment, which when using an SSH-backed execution transport resulted in the secrets appearing in the command line arguments of the spawned process. A local attacker could observe these credentials via process listing. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/635 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/635 Wed, 26 Aug 2026 02:24:50 GMT Before the patch, provider catalog discovery did not restrict execution to the provider identities selected for an agent. Any globally configured provider hook would run, resolving its credentials and fetching its models, even when the agent was not authorized to use that provider. This allowed an attacker with limited provider permissions to trigger discovery for out-of-scope providers and then use those models, bypassing access controls and potentially consuming shared credentials. The patch adds guards that return null when ctx.providerIds does not include the provider's own ID, and the runtime filters results to the selected identities. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/626 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/626 Wed, 26 Aug 2026 00:38:39 GMT Before the patch, the read-only session catalog facade exposed providers without enforcing the active profile's process-HOME isolation. A named/relocated profile that disabled process-HOME session scanning would still allow internal consumers (e.g., the Beam mirror) to list and read sessions from the main user HOME, enabling unauthorized exfiltration of private conversation transcripts outside the isolation boundary. The patch propagates allowProcessHomeFallback into all list/read calls and reports the policy to consumers. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/627 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/627 Wed, 26 Aug 2026 00:40:22 GMT Before the patch, agent-created cron jobs could be attributed to an arbitrary actor via a trusted hint in the agent runtime's spawn context. Because the creator actor is used to establish the identity and permissions of subsequent automation runs, a malicious or prompt-injected agent could forge the creator to impersonate another user and execute automations with that user's privileges. The patch replaces this trusted hint with the immutable creator stored on the exact session, preventing spoofing. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/628 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/628 Wed, 26 Aug 2026 00:41:50 GMT The skill installer download path piped HTTP response bodies directly to disk without any size limit. A malicious skill author could provide a download URL that returns an endless or extremely large response, causing the victim's disk to fill up and potentially making the system unusable. The patch adds a 256 MiB cap and aborts transfers when exceeded. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/629 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/629 Wed, 26 Aug 2026 00:46:05 GMT Before this patch, certain Git operations used during GitHub publication (e.g., push via githubPublicationPushArgs, recovery write-tree) did not explicitly disable Git hooks. An attacker who could influence a repository's core.hooksPath configuration could inject malicious hooks that would execute arbitrary code on the machine running the publication automation. The patch adds `-c core.hooksPath=os.devNull` to all such hook-capable Git commands, ensuring hooks are suppressed regardless of repository configuration. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/624 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/624 Wed, 26 Aug 2026 00:00:42 GMT Before the patch, the embedding cache key for Mistral and DeepInfra providers only included the provider name and model. When different tenants or deployments used the same model but different custom endpoints or semantic headers (e.g., X-Tenant, X-Deployment), their memory embedding indexes silently collided, allowing one tenant's stored embeddings to be retrieved by another. The patch partitions the cache by adding the sanitized destination baseUrl and headers (excluding rotating credentials) for non-default configurations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/625 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/625 Wed, 26 Aug 2026 00:02:46 GMT Before the patch, the Buzz relay information fetch used `response.json()` without any size limit, allowing a malicious or compromised Nostr relay to return an arbitrarily large or never-ending JSON response. This could exhaust Gateway memory and crash the process. The patch replaces it with `readProviderJsonObjectResponse`, which enforces a 16 MiB limit and cancels the stream when exceeded. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/622 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/622 Tue, 25 Aug 2026 23:37:07 GMT The Buzz setup contract had a resolveAccountId function that always returned 'default', causing any named account request (e.g. --account attacker) to be treated as the default account, bypassing the single-account validation. An attacker who convinces an admin to run a setup command with attacker-controlled private key and relay URL could overwrite the existing default bot identity, enabling account takeover. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/619 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/619 Tue, 25 Aug 2026 23:14:01 GMT The WhatsApp login tool was registered through a channel-tool surface that did not pass the sender-owner fact, allowing any write-scoped non-owner to invoke the tool and force a QR relink. This could clear saved WhatsApp credentials and permit the attacker to link the bot to their own device, taking over the WhatsApp channel. The patch moves registration to an owner-aware factory and adds abort checks before credential persistence. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/620 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/620 Tue, 25 Aug 2026 23:15:08 GMT The portal proxy used a cookie prefix derived from the target port (`oc_portal_<targetPort>_`). Because browser cookies are hostname-scoped, cookies set by a previous portal for the same target port were retained and later forwarded to a new portal instance on that port, leaking application session cookies to an unintended target. The patch replaces the port-based prefix with a random per-portal-instance namespace, ensuring cookies from closed portals are rejected. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/621 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/621 Tue, 25 Aug 2026 23:16:51 GMT Before the patch, the agent-facing terminal tool could create its own Gateway-hosted PTY and send input directly, ignoring the session's execution permission policy (read-only, guarded, workspace, deny). This allowed a compromised or prompt-injected agent to execute arbitrary shell commands on the host even when the operator had explicitly forbidden command execution. The patch enforces the effective exec session policy and adds a final authority fence before any terminal input is written to the PTY. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/612 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/612 Tue, 25 Aug 2026 22:04:43 GMT MCP App views could continue to list and read resources from their owning MCP server after the view's App-interaction authority was revoked or never granted (e.g., reconstructed read-only views). The patch enforces a current App-interaction authority check before and after each resource operation, preventing unauthorized data disclosure. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/604 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/604 Tue, 25 Aug 2026 21:18:48 GMT The patch adds a missing authorization check for MCP App resource operations. Prior to this fix, `resources/list`, `resources/templates/list`, and `resources/read` were performed without verifying the current App-interaction authority, allowing a view whose grant was revoked (or a read-only reconstructed view) to still list and read same-server resources. The fix wraps these operations with `withMcpAppResourceAuthority`, which calls `requireMcpAppInteraction` before and after the upstream work, and stops advertising the resource capability without valid authority. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/613 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/613 Tue, 25 Aug 2026 22:07:57 GMT The PortPreview iframe previously included 'allow-same-origin' by default (terminalPreviewAllowSameOrigin default true). Because the iframe src is a same-origin proxy URL, arbitrary HTML/JavaScript served on the previewed port could execute in the same origin as Open WebUI, allowing it to access parent cookies/localStorage and exfiltrate the user's session. The patch changes the default to false, removing 'allow-same-origin' from the sandbox and isolating the iframe's origin. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/605 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/605 Tue, 25 Aug 2026 21:22:29 GMT Before the patch, the terminal port preview iframe sandbox defaulted to including `allow-same-origin` together with `allow-scripts`. This combination effectively disables the sandbox for same-origin content, allowing untrusted content served through the terminal port proxy to access the parent Open WebUI origin and exfiltrate session tokens or perform actions as the victim. The patch changes the default to `false`, ensuring the iframe sandbox no longer grants same-origin access by default. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/614 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/614 Tue, 25 Aug 2026 22:12:55 GMT The default value for RAG_METADATA_MAX_VALUE_CHARS was None, meaning document metadata extracted from uploaded files had no size limit. An attacker could upload a small crafted Office document (zip bomb) that expands to gigabytes of metadata during extraction, exhausting server memory and causing a denial of service. The patch falls back to the configured upload size limit (RAG_FILE_MAX_SIZE) when no explicit metadata limit is set. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/606 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/606 Tue, 25 Aug 2026 21:26:51 GMT Before the patch, if RAG_METADATA_MAX_VALUE_CHARS was not explicitly set, extracted document metadata was allowed to be unbounded in size. A crafted Office document (zip archive) could expand from a few hundred kilobytes to gigabytes of metadata during extraction, causing memory exhaustion and denial of service. The patch defaults the metadata limit to the configured RAG_FILE_MAX_SIZE (in MB) when the explicit metadata limit is absent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/603 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/603 Tue, 25 Aug 2026 20:00:55 GMT Before this patch, VectorSearch skipped server-side per-result access checks for external vector collections (coll.IsExternal). Any authenticated user with access to the vector search endpoint could retrieve all rows from an external collection, bypassing folder-scoped RBAC for resources such as alert rules. The patch adds BatchCheck enforcement for external collections and introduces a folder field to EmbeddingInput to validate per-row authorization. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/607 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/607 Tue, 25 Aug 2026 21:28:32 GMT Before the patch, the code interpreter tag detector ran regardless of the tool-calling mode. In native (agentic) mode, a model that emitted a `<code_interpreter>` block in its reply text—whether due to prompt injection or unintended output—had the contained Python code executed on the server. The patch restricts tag detection to legacy tool-calling mode only, preventing execution of code from ordinary model responses. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/602 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/602 Tue, 25 Aug 2026 19:44:59 GMT The legacy IPv4 loopback parser only recognized dotted-decimal IPv4 addresses and missed IPv4-mapped IPv6 loopback forms like \[::ffff:127.0.0.1\]. This caused such local endpoints to be classified as remote, leading the Ollama plugin to attach ambient cloud credentials (e.g., OLLAMA_API_KEY) to discovery requests sent to the local loopback address. An attacker controlling a service on that localhost port could capture the credentials. The patch replaces the duplicate parser with the canonical SDK loopback helper to correctly classify mapped loopback addresses as local and prevent credential forwarding. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/615 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/615 Tue, 25 Aug 2026 22:17:13 GMT The code before the patch failed to verify user access to the fallback model when a custom model's base model was missing and ENABLE_CUSTOM_MODEL_FALLBACK was enabled. An attacker with permission to use a custom model could set its base_model_id to a non-existent model to trigger fallback to the admin-configured default model, bypassing model-level access controls. The patch adds an explicit check_model_access call for the fallback model. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/608 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/608 Tue, 25 Aug 2026 21:34:08 GMT The original code checked model access only for the requested custom model before potentially replacing it with a fallback model when the custom model's base model was missing. A user with access to the custom model but not the fallback model could trigger the fallback and use an unauthorized model. The patch adds an explicit access-control check on the fallback model, preventing this privilege escalation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/601 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/601 Tue, 25 Aug 2026 19:09:08 GMT In multi-team mode, Apache Airflow mounted team-scoped plugin FastAPI apps without any authorization middleware. Any authenticated user could access endpoints intended only for members of a specific team, leading to unauthorized data access and privilege escalation. The patch adds TeamAuthorizationMiddleware to enforce team membership on team-scoped plugin mounts. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/600 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/600 Tue, 25 Aug 2026 16:55:00 GMT Before the patch, the file-system incremental cache built file paths by directly joining the request pathname with the cache root directory, without validating the result. On Windows, encoded backslashes (`%5C`) in dynamic segments decoded to path separators, allowing `..%5C..%5C` sequences to traverse outside the cache directory (e.g., from `server/pages` to `.next/server-reference-manifest.json`). An attacker could request a crafted data URL and read arbitrary JSON files from the server, including the server actions encryption key. The patch adds a check that the resolved path remains within the cache root and escapes backslashes in route delimiters. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/598 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/598 Tue, 25 Aug 2026 16:08:48 GMT The OIDC RP-initiated logout endpoint accepted an 'initiating_idp' query parameter that, when set to a broker alias, suppressed logout at that upstream identity provider. An attacker could craft a malicious logout URL containing this parameter to terminate the local Keycloak session while leaving the upstream IDP session active, enabling silent re-authentication without credentials on a shared device. The patch changes the default to ignore the parameter and requires an explicit server configuration option to restore the legacy behavior. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/616 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/616 Tue, 25 Aug 2026 22:23:13 GMT Before the patch, SSRF protections were only applied during initial URL validation and DNS resolution. Redirect targets were not revalidated, and aiohttp handles IP-literal hosts directly without consulting the DNS resolver, so a submitted public URL could redirect to 169.254.169.254 or other internal/cloud metadata addresses when AIOHTTP_CLIENT_ALLOW_REDIRECTS=true. The response body would be returned to the caller, leaking cloud credentials or internal service data. The patch adds per-request and per-connection checks that validate every hop, including redirects and IP-literal connections. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/609 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/609 Tue, 25 Aug 2026 21:42:04 GMT The pre-patch code validated only the originally submitted URL and, on aiohttp paths, only checked DNS-resolved addresses. Redirects to IP literals such as 169.254.169.254 bypassed both the private-IP check and WEB_FETCH_FILTER_LIST, allowing an attacker to make the server fetch internal/cloud-metadata endpoints and return their contents when redirects are enabled. The patch moves the checks into per-request connection hooks that run on every hop, including redirects. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/597 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/597 Tue, 25 Aug 2026 15:30:27 GMT Before the patch, autonomous skill updates in `auto` mode could target any workspace skill, including user-authored skills, because the apply path did not recheck ownership at the write boundary and used name-based heuristics. This allowed an attacker who could influence the agent (e.g., via prompt injection from a malicious document or webpage) to have their update proposal automatically applied to a user's handwritten skill, leading to unauthorized file modification and potential arbitrary command execution when the skill is later invoked. The patch enforces path-based ownership rechecks under a commit lock and restricts automatic application to Workshop-authored skills, keeping user-authored updates pending operator approval. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/610 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/610 Tue, 25 Aug 2026 21:46:38 GMT Before the patch, an authenticated user with model creation or update permissions could set a model's base_model_id to its own id. During model retrieval or chat completion, the application recursively resolves base model parameters, causing infinite recursion and a denial of service (500 errors) for any user interacting with that model. The patch ensures base_model_id is never set to the model's own id by nullifying it. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/596 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/596 Tue, 25 Aug 2026 14:01:54 GMT The ngrok authentication token was passed as a command-line argument to `ngrok config add-authtoken`, making it visible in the child process argv. Any local user or process could read `/proc/<pid>/cmdline` or `ps` output to steal the token. The patch removes the subprocess call and instead sets the `NGROK_AUTHTOKEN` environment variable for the ngrok tunnel process, preventing exposure via process arguments. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/595 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/595 Tue, 25 Aug 2026 13:11:59 GMT In multi-tenant deployments, the SSOSettingsStore used a fixed database connection and ignored tenant context, causing OAuth login for one tenant to read SSO settings from the shared table. This allowed SSO configuration from one tenant to be applied to another, potentially enabling cross-tenant authentication bypass. The patch resolves the legacy database provider from the request context and uses the tenant-specific table name. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/592 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/592 Tue, 25 Aug 2026 11:02:07 GMT Before the patch, when a placement dispatch or move was already in-flight for a session, a second caller with an identical request joined the existing operation without invoking their own authorize callback. An operator whose session access was revoked during that window could still receive a successful placement result, bypassing per-request placement authority. The patch adds a joinOperation wrapper that revalidates each joining caller's authority before and after the shared work, and replaces partial request comparison with full deep equality to prevent mismatched paired-device placements. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/591 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/591 Tue, 25 Aug 2026 10:21:21 GMT Before the patch, the Reef extension exposed setActiveReef and getActiveReef through its public API, and the returned runtime object contained outbound, pairing, friendship, and review capabilities that did not check whether the underlying account was still active. A malicious extension could obtain a reference to the active Reef runtime, wait for the account to be stopped or replaced, and then continue to send messages, approve pairings, or read data as the retired account without authorization. The patch introduces a generation-specific authority that is revoked when the account aborts or is replaced, ensuring all borrowed capabilities fail closed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/590 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/590 Tue, 25 Aug 2026 09:57:46 GMT Before the patch, isLocalOllamaBaseUrl only recognized 127.0.0.1 as IPv4 loopback, so other 127/8 addresses like 127.0.0.2 or 127.1.2.3 were classified as remote. This caused the Ollama plugin to send the ambient OLLAMA_API_KEY (cloud credential) to a server on those addresses instead of the synthetic local authentication. The patch reuses the full IPv4 loopback detector so all 127/8 addresses are treated as local, preventing the cloud credential from being sent to local loopback aliases. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/589 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/589 Tue, 25 Aug 2026 09:15:16 GMT The patch fixes an HTTP Parameter Pollution vulnerability in Keycloak's redirect URI validation. Before the fix, attackers could include OIDC response parameters (like 'state', 'code', 'session_state') in redirect_uri or post_logout_redirect_uri. Keycloak would append its own parameters, creating duplicates. This could allow an attacker to control the first parameter value seen by applications, bypassing CSRF protections or enabling open redirects. The patch rejects such URIs by default and improves query parameter replacement to handle percent-encoded names. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/588 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/588 Tue, 25 Aug 2026 08:37:36 GMT Before the patch, Keycloak's refresh token reuse detection only rejected a stale token if its issued-at timestamp (iat) was strictly less than the stored last refresh timestamp. If an old and new refresh token were issued in the same second their iat values were equal, allowing an attacker to replay a stolen refresh token after legitimate rotation and obtain new tokens. The patch stores the latest generated refresh token ID and uses <= comparison to catch same-second replays. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/587 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/587 Tue, 25 Aug 2026 08:30:12 GMT Before the patch, `resolveMemoryWikiConfig` computed default vault paths from `os.homedir()` and ignored the `OPENCLAW_STATE_DIR` environment variable. An isolated agent run or Doctor migration could therefore read, delete, or archive the operator's real Memory Wiki data under `~/.openclaw/wiki`. The patch uses `resolveStateDir` to honor the configured state directory, keeping isolated runs within their intended filesystem boundary. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/584 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/584 Tue, 25 Aug 2026 07:57:39 GMT The TUI plugin approval and task suggestion controllers matched prompts solely by session key string, ignoring the explicit agentId for non-global sessions. An attacker who can publish events with a victim's session key but their own agentId could cause an approval prompt to appear in the victim's terminal, tricking the operator into approving actions for the attacker's agent. The patch introduces `matchesOwnedTuiSession` to ensure the prompt's owner matches the selected agent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/585 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/585 Tue, 25 Aug 2026 08:00:32 GMT The plugin inspection command resolved plugins by checking either the exact ID or the display name without prioritizing exact ID. An attacker could install a plugin with a display name equal to another plugin's ID, causing a request to inspect the legitimate plugin to load and execute the attacker's plugin instead, leading to arbitrary code execution. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/586 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/586 Tue, 25 Aug 2026 08:02:10 GMT The gateway history projection failed to filter phased assistant text blocks of type 'output_text' or 'input_text', causing internal assistant commentary (non-final_answer phases) to be exposed in session history. The patch reuses the assistant text classifier to correctly identify all phased text block types, ensuring only final_answer content is shown. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/583 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/583 Tue, 25 Aug 2026 07:07:43 GMT Anthropic native tools (Bash, Read, Write, Edit, WebFetch, WebSearch) bypassed OpenClaw's before_tool_call policy hooks and canonical tool policies because the native permission handler did not map native tool names/arguments (e.g., Bash→exec, file_path→path) to OpenClaw canonical equivalents. This allowed users to execute shell commands or read/write files that were explicitly blocked by configured security policies, leading to remote code execution or sensitive data exfiltration. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/582 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/582 Tue, 25 Aug 2026 04:29:11 GMT The downloadSlackFile function did not require positive proof that a file was shared in the requested Slack channel. Files with absent channel/share metadata or share-map keys with empty/invalid entries were treated as authorized, and blank channel IDs bypassed scope checks entirely. An attacker who knows a file ID from a private channel could cause the bot to fetch and return the file outside the authorized conversation. The patch requires nonblank channel and valid timestamped share entries, failing closed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/617 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/617 Tue, 25 Aug 2026 22:27:42 GMT Before the patch, archive-based document uploads (.docx, .xlsx, .pptx, .odt, .epub) were passed directly to extraction loaders without validating decompressed size. An authenticated user could upload a small compressed zip bomb that expands to gigabytes, exhausting server memory/disk and causing a denial of service. The patch inspects the ZIP central directory and rejects archives whose uncompressed size exceeds a computed limit. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/611 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/611 Tue, 25 Aug 2026 21:48:09 GMT Before the patch, the document loader did not validate the uncompressed size of archive-based file formats such as DOCX, XLSX, PPTX, EPUB, and ODT. An attacker could upload a small compressed file that expands to many gigabytes, causing memory or disk exhaustion and denial of service. The patch adds an uncompressed size check and raises ValueError if the expanded content exceeds the configured maximum file size. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/581 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/581 Tue, 25 Aug 2026 00:32:15 GMT Before this patch, the update.run protocol did not accept an exact Git commit target, so a caller who froze a commit via update.status could not ensure that update.run would install that same commit. If the upstream branch advanced between the status and run calls, the updater could install a different, potentially malicious commit. The patch adds an optional target parameter that binds the update to a specific commit SHA and upstream reference. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/580 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/580 Mon, 24 Aug 2026 22:12:19 GMT Before the patch, getReadPathVariants normalized Unicode spacing, quotes, and Unicode NFC/NFD forms across the entire file path, including parent directories. In workspace-only read mode, after the initial exact path was authorized, fallback variants could alter the Unicode normalization of a parent directory and point to a sibling directory outside the allowed workspace, allowing reads of arbitrary files outside the workspace. The patch restricts fallback transformations to the basename only, preserving the already-authorized parent directory byte-for-byte. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/579 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/579 Mon, 24 Aug 2026 21:50:51 GMT Before this patch, the cron scheduler used the raw `job.agentId` when enqueueing notifications and wakeups for scheduled scripts, and it omitted the session's delivery context for main-session jobs. If a script job did not have an explicit `agentId` (inheriting it from its session or the default), the notification could be delivered to the wrong agent or even a shared default agent, leaking potentially sensitive script output to other users. The patch resolves the correct owning agent with `resolveCronJobEffectiveAgentId` and includes the session's `deliveryContext` to ensure messages reach the intended Telegram thread and account. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/578 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/578 Mon, 24 Aug 2026 19:09:26 GMT Before the patch, the synthetic SSF event emitter resolved tenant subjects from arbitrary HTTPS URIs (last path segment) and any IssuerSubjectId without checking the issuer, and it treated a subscribed tenant as an independent allow signal. An attacker with the emit role could pair an unsubscribed or non-member user with a subscribed organization and have the event dispatched to that organization's subscribers, causing a signed SET to assert an identity relationship Keycloak never validated. The patch enforces strict tenant resolution (realm-owned URNs/realm issuer only), requires user membership in the tenant, and delegates user-subject gating to the native dispatcher. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/577 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/577 Mon, 24 Aug 2026 16:53:03 GMT Before the patch, native command continuations (Discord button clicks, argument selections, model picker interactions) did not forward the dispatcher tied to the admitted Gateway instance. This allowed an attacker to trigger a continuation that would fall back to an ambient dispatcher from a different Gateway, potentially executing commands or sending replies using the victim's credentials and terminal context. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/576 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/576 Mon, 24 Aug 2026 16:04:37 GMT Before the patch, cloud-managed nodes (worker records with a nodeDeviceId) were excluded from the managed set only when their state was not failed or orphaned. A failed/orphaned worker that still retained its node binding would cause its cloud node to be listed as an ordinary paired-device environment, allowing unauthorized users to treat infrastructure-owned nodes as regular devices. Additionally, worker inventory read errors silently returned an empty list, causing all cloud nodes to be exposed. The patch fixes this by treating failed/orphaned workers as retaining ownership unless destroyed and by failing closed on inventory read failures. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/575 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/575 Mon, 24 Aug 2026 14:57:17 GMT The KeycloakIdentity class directly checked a user's role assignments for admin roles without verifying whether the authenticating client's scope included the role. This allowed a user with admin roles to exercise those roles through any client, even one whose client scope did not grant them, bypassing client scope restrictions. The patch adds checks to ensure that admin roles are only considered if the requesting client's scope includes them or the access token contains the role. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/599 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/599 Tue, 25 Aug 2026 16:12:18 GMT The notification controller's getAppProj function retrieved an AppProject object from the shared informer cache and mutated its annotations in place. Since informer cache objects are shared among goroutines, concurrent calls to getAppProj for multiple applications referencing the same project could result in concurrent map writes, causing a fatal runtime error and crashing the notification controller. The patch deep-copies the object before mutation, ensuring the cache is not modified. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/574 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/574 Mon, 24 Aug 2026 14:12:19 GMT The previous code logged OAuth access tokens and refresh tokens in debug-level logs during token refresh. This exposed bearer credentials to anyone with read access to Grafana logs, potentially enabling account takeover. The patch replaces raw token values with boolean presence indicators. Patch landed 1 hour 51 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/573 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/573 Mon, 24 Aug 2026 13:31:43 GMT The UI's real-time session reconciliation logic allowed broadcast session events to add new rows to filtered session lists, bypassing the 'Involving me' or configured-agent filters. This leaked the existence and metadata (label, key, owner, status) of unrelated sessions to users who should not see them. The patch enforces that only the canonical sessions.list result may admit new rows, preventing filtered lists from being expanded by events. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/572 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/572 Mon, 24 Aug 2026 12:22:58 GMT Before the patch, `resolvePlacementIdentity` ignored the supplied `agentId` and `sessionKey` when a placement existed, using the placement's persisted identity instead. An attacker who knew only a victim's session ID could submit a worker turn with arbitrary or blank identity fields and the gateway would execute the turn under the victim's placement identity, granting unauthorized access to the victim's workspace. The patch enforces that any supplied identity field is non-empty and matches the persisted placement before workspace resolution, claim acquisition, or redispatch. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/571 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/571 Mon, 24 Aug 2026 09:49:04 GMT Before the patch, restart recovery could archive a source session and create its successor while the source still owned an active cloud worker. This allowed the worker's remote execution and final workspace changes to be attributed to a retired session identity, bypassing the session lifetime security boundary. The patch forces reclaim of the cloud worker and adds a lifecycle revision check before the archive commit. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/570 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/570 Mon, 24 Aug 2026 09:04:39 GMT Before the patch, dynamic tool building for Codex used the raw `params.permissionMode`, `params.sessionRoot`, and `execOverrides` from the conversation source, ignoring server-side Codex requirements and app-server clamps. This allowed a stale or malicious conversation with `permissionMode: 'full'` and `execOverrides.mode: 'full'` to bypass an administrator's tightened workspace/guarded approval policy and execute arbitrary shell commands with automatic approval. The patch resolves a single effective permission policy from the final app-server configuration and overwrites the raw params so all execution paths (dynamic tools, Gateway alias, compaction) use the clamped policy. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/565 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/565 Mon, 24 Aug 2026 08:10:40 GMT Before the patch, the telemetry payload included raw channel and provider identifiers from the user's configuration. A private plugin name such as 'acme-internal-crm' or 'acme-llm' would be sent to the telemetry endpoint despite the documented promise that no identifying information is sent, potentially revealing the user's organization or internal projects. The patch filters these values to only publicly known identities and reports private plugins anonymously via counts. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/569 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/569 Mon, 24 Aug 2026 08:23:14 GMT With gzip compression enabled, each HEAD request carrying Accept-Encoding: gzip caused a permanent goroutine leak because web.ResponseWriter reported a short write (0, nil), and pgzip's Close returned without releasing the compressor goroutine. Repeated requests exhaust memory and goroutines, allowing remote denial of service. The patch skips compression for HEAD responses and reports dropped HEAD bodies as fully written. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/566 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/566 Mon, 24 Aug 2026 08:13:01 GMT Subagent logs and completion announcements used a content-only extractor that ignored the assistant message phase, causing private 'commentary' (intermediate reasoning) to be exposed to operators. The patch routes extraction through the canonical sanitized history extractor, which filters commentary and only returns final_answer content. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/567 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/567 Mon, 24 Aug 2026 08:18:37 GMT Before the patch, error responses from Ollama embedding/streaming/web-search requests were read and thrown as Error messages without redacting request credentials. If a malicious or misbehaving endpoint/intermediary reflected an Authorization or custom secret header in the error body, the credential would be exposed to logs and operators/agents. The patch adds a helper that removes secret values in raw, JSON, URI-encoded, form-encoded, and truncation-boundary forms before the error is surfaced. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/568 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/568 Mon, 24 Aug 2026 08:21:55 GMT Before the patch, ensureLmstudioModelLoaded included raw response bodies from the model-load endpoint in thrown Error messages without redacting sensitive credentials. A malicious or compromised server could reflect the API key or custom authentication headers back in the error body, causing those secrets to be logged or displayed to operators. The patch builds the outbound headers first, redacts exact credential values and bare Authorization payloads from error bodies and unexpected statuses, and suppresses truncated bodies where redaction cannot safely identify credentials. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/563 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/563 Mon, 24 Aug 2026 07:18:38 GMT The node.invoke command allowlist was evaluated before an asynchronous pairing revalidation. If an administrator revoked a command during that await, the command still dispatched because the final isDispatchAuthorized gate did not recheck the command policy. The patch re-resolves the allowlist inside the closure to fail closed on revocation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/564 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/564 Mon, 24 Aug 2026 07:23:49 GMT The embedded TUI model picker fell back to the full unrestricted provider catalog when an agent's restrictive model policy returned an empty allowed list, effectively ignoring the policy. This fail-open behavior allowed users to select and run models prohibited by the selected agent's model policy. The patch removes the fallback and honors the authoritative empty allowed catalog. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/562 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/562 Mon, 24 Aug 2026 04:05:02 GMT Before the patch, memory search embedding providers (e.g., Gemini) would send provider-owned API keys and headers to any custom remote.baseUrl configured in memory.search.remote, even if that endpoint was not the provider's canonical destination. This allowed an attacker or misconfigured operator to exfiltrate provider credentials to an arbitrary URL. The patch enforces that provider credentials and headers are only used when the remote destination matches the provider's configured base URL (including query parameters), and requires explicit remote.apiKey for other destinations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/561 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/561 Mon, 24 Aug 2026 03:14:43 GMT Before the patch, delivery authority was checked only once before initiating a Discord send. If the send failed transiently and was retried, or if later separate physical sends occurred (e.g., media caption overflow), the authority was not revalidated, allowing a canceled, suppressed, or retired pending reply to still be delivered. The patch moves the authority callback into the request/retry function so it is enforced immediately before each actual provider I/O attempt. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/560 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/560 Sun, 23 Aug 2026 21:56:13 GMT Before the patch, Feishu credential resolution in inspect mode would read environment variables referenced by SecretRef objects without validating the secret provider policy, allowing disallowed environment variables to be used as authentication credentials. This could lead to unintended credential use and potential authentication bypass. The patch enforces the policy by checking canResolveEnvSecretRefInReadOnlyPath before reading the environment variable. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/558 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/558 Sun, 23 Aug 2026 21:34:14 GMT The code highlighter tokenizer classifies Unicode numerals as numeric tokens, but the consuming loop only advances over hexadecimal digits and ASCII punctuation. When a Unicode numeral (e.g., '①') is encountered, the token becomes empty and the cursor is not advanced, causing an infinite loop and unbounded memory growth. This freezes the application when rendering source code blocks containing such characters, allowing a remote attacker to send a malicious code snippet to crash or hang the app. The patch aligns the consuming condition with the token classification by adding `chars\[end\].isNumber`. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/559 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/559 Sun, 23 Aug 2026 21:36:53 GMT Before the patch, administrative session events such as sharing visibility and membership changes were appended to the conversation transcript as messages with excludeFromContext set to true. However, the session projection logic only filtered bashExecution messages with that flag, so these administrative messages were still projected into the model context as user messages. Since these messages could include user-controlled display names, an attacker could inject malicious instructions into the model's context by setting their display name to a prompt injection payload and triggering an admin action. The patch generalizes the excludeFromContext filter to all message types, preventing such untrusted administrative notes from reaching the model. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/557 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/557 Sun, 23 Aug 2026 16:43:24 GMT Before the patch, archiving or unarchiving a session appended a system note to the conversation transcript containing the actor's display name, which is user-controlled. This note was later treated as part of the model's context, allowing a malicious user to inject arbitrary instructions into the conversation history of any other user who loads that session, leading to prompt injection attacks. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/556 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/556 Sun, 23 Aug 2026 15:56:21 GMT Before the patch, widget iframes granted `allow-popups` and `allow-popups-to-escape-sandbox` to every rendered widget, including those with `grantState: "none"` and `connect-src 'none'`. An untrusted widget could use a `target="_blank"` anchor or popup navigation to open an arbitrary external URL in a new, fully unsandboxed tab, bypassing network isolation and CSP restrictions. The patch removes those sandbox flags and routes user-clicked links through a validated host bridge with `noopener,noreferrer`. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/555 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/555 Sun, 23 Aug 2026 13:31:06 GMT The Matrix poll summary pagination loop would continue indefinitely if a homeserver returned a repeated or cyclic opaque cursor in the `nextBatch` field of `getRelations` responses. A malicious or compromised homeserver could cause the bot to hang on poll processing, leading to denial of service. The patch tracks previously seen cursors and throws an error when a repeat is detected, breaking the cycle. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/554 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/554 Sun, 23 Aug 2026 11:10:35 GMT Before the patch, fetchLinkContent threw an error on non-OK HTTP responses without cancelling or consuming the response body. Under Undici 8.9, fetch() resolves after headers, so an attacker-controlled URL returning a non-success status with a stalled body could leave the underlying socket occupied indefinitely. Repeated fetches would exhaust the connection pool, causing denial of service. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/553 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/553 Sun, 23 Aug 2026 08:15:09 GMT A queued agent turn that was admitted before a credential hot reload could re-publish its retired runtime configuration (including old credentials) as the current owner. This defeated credential rotation and allowed revoked credentials to remain in use. The patch fences old generations and only permits borrowing the exact snapshot through an active outer lease, otherwise rejecting with 'superseded'. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/552 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/552 Sun, 23 Aug 2026 02:09:35 GMT The old `isGraphSharedLinkUrl` used `host.endsWith(suffix)` without a label boundary, allowing look-alike domains like `evil1drv.ms`, `notonedrive.com`, or `fakeonedrive.live.com` to be treated as OneDrive/SharePoint shared links. This caused the bot to obtain an access token and, via the auth fallback, send it to the attacker-controlled host. The patch requires a dot-prefixed suffix and HTTPS, preventing token leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/551 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/551 Sat, 22 Aug 2026 11:10:45 GMT Before the patch, node command identifiers were printed directly to the terminal without sanitization. A malicious or compromised node could supply an identifier containing terminal escape sequences and newlines to clear the screen or forge output lines, misleading the user. The patch sanitizes the identifier with sanitizeTerminalText for human-readable output while preserving raw values in JSON. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/550 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/550 Sat, 22 Aug 2026 09:16:11 GMT Before the patch, Discord voice transcripts were stored in RawBody, CommandBody, and CommandTurn.body as if typed by the user, without untrusted framing. A malicious user could send a voice message whose transcript contains a slash command or prompt injection, causing the bot to classify and execute it as a user-typed command, bypassing the intended separation between machine-generated untrusted input and typed commands. The patch routes transcripts through formatAudioTranscriptForAgent and removes them from command-bearing fields. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/547 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/547 Sat, 22 Aug 2026 02:05:59 GMT The code before the patch automatically injected memory content from MEMORY.md and USER.md (or any entry with originClass owner/agent) into the agent's context without verifying provenance. An attacker who could cause untrusted content to be stored in these curated memory files (classified as originClass 'untrusted') would have that content automatically included in the prompt via bootstrap or Active Memory trigger recall, enabling prompt injection and potential agent hijacking. The patch replaces the path-based and originClass-based checks with a provenance-aware isAutomaticMemoryEntryEligible function and fails closed when provenance is missing or unsupported. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/548 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/548 Sat, 22 Aug 2026 02:09:59 GMT When an explicitly configured SecretRef was unavailable, the system would silently discard the reference and fall back to ambient credentials (e.g., environment variables), leading to authentication and actions as an unintended account. The patch adds assertions that cause operations to fail closed when a configured credential is unavailable, preventing identity confusion and potential privilege escalation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/545 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/545 Fri, 21 Aug 2026 22:59:40 GMT Before the patch, session creation accepted unconfigured agent IDs, leading to sessions that later dispatch, reclaim, and delete APIs refused to manage. Attackers could create managed worktrees for these orphaned sessions, causing unbounded resource consumption on the host and eventual denial of service. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/544 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/544 Fri, 21 Aug 2026 22:40:50 GMT The gateway cached HTTP auth-bypass paths in a WeakMap keyed only by config object identity. When a channel plugin's metadata/lifecycle changed while the config object stayed identical, the old bypass paths remained cached, allowing unauthenticated access to routes that should now be protected. The patch invalidates the cache on plugin metadata lifecycle resets. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/543 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/543 Fri, 21 Aug 2026 21:58:23 GMT The CLI 'approvals --json' commands printed the exec-approvals socket token in clear text in the file.socket.token and raw fields. This token is the HMAC key used to derive the local operator approval runtime token, which authorizes local operator-approval clients. An attacker who can read the JSON output (e.g., from logs or a shared terminal) can recover the token, derive the operator approval token, and connect to the local exec-approvals socket to approve or deny command execution, bypassing the operator approval mechanism. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/542 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/542 Fri, 21 Aug 2026 19:35:38 GMT Before the patch, the gateway's conversation tools admitted and consumed conversation references without verifying that the current channel route belonged to the active agent. This allowed a multi-agent operator's agent to discover or deliver to conversations owned by other agents or external routes, leading to unauthorized message delivery and potential data exfiltration. The patch introduces per-channel owner resolvers and enforces ownership checks across all conversation operations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/540 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/540 Fri, 21 Aug 2026 19:14:18 GMT The PKI secrets engine's key update endpoint did not enforce uniqueness of the 'key_name' field. An attacker with permission to update their own key could rename it to match an existing key's name, creating duplicate names. Since many PKI operations resolve key references by name, this ambiguity could lead Vault to use the attacker's key when creating issuers or signing certificates. The patch calls getKeyName to reject duplicate names, except when the new name resolves to the same key. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/539 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/539 Fri, 21 Aug 2026 19:10:03 GMT Before the patch, the scope resolver unconditionally expanded permissions:type:delegate to a wildcard scope for all RBAC actions. This meant that a user granted only delegation rights for a specific action (e.g., dashboards:read) could also perform that action on every resource, effectively obtaining global access to the action's target resource. The fix restricts wildcard expansion to role-management actions, ensuring delegate grants only delegate and do not grant the underlying action itself. Patch landed 2 days 20 hours 23 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/537 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/537 Fri, 21 Aug 2026 19:04:10 GMT Before the patch, `claws remove` deleted an agent from the active config but left its exec-approvals policy in the shared state DB keyed by the raw agent ID. A later agent reusing that ID silently inherited the old allowlist, bypassing the intended default-deny policy and allowing execution of commands that were only approved for the removed agent. The patch wraps the removal in `withAgentExecApprovalsRemoved` so the approvals are cleaned up atomically with the config change. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/541 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/541 Fri, 21 Aug 2026 19:16:15 GMT The PKI key update endpoint did not validate uniqueness of the key name, allowing a user with permission to rename a key to set it to a name already used by another key. This could cause name resolution collisions where operations referencing the key by name might affect the wrong key, leading to denial of service or operational confusion. The patch adds a uniqueness check and rejects duplicate names unless the new name resolves to the same key. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/536 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/536 Fri, 21 Aug 2026 17:53:27 GMT Before the patch, when the request-scoped plugin registry was missing, the code fell back to the process registry, exposing the raw outbound adapter to plugin tool code. This allowed a malicious plugin to choose arbitrary destination, account, thread, and media roots, bypassing host authorization and enabling arbitrary message injection and potential file exfiltration. The patch removes the fallback and binds delivery to the host-selected route and current turn, revoking authority at turn closure. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/535 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/535 Fri, 21 Aug 2026 15:56:25 GMT The FullScopeDisabled client policy executor did not enforce its restriction when the 'fullScopeAllowed' attribute was omitted from a client registration or update request. Since Keycloak defaults fullScopeAllowed to true for new clients when the field is absent, an attacker could register a client without specifying fullScopeAllowed and still get a client with full scope allowed, bypassing the policy. The patch treats missing (null) values as true and adds update-specific logic to prevent the bypass. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/532 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/532 Fri, 21 Aug 2026 14:08:16 GMT The ClientAccessTypeCondition evaluated the existing client's access type instead of the proposed type during client updates. This allowed clients to bypass client policies that restrict certain access types, e.g., a public client could be updated to confidential while retaining a forbidden configuration such as direct access grants enabled. The patch checks the proposed access type for update operations, ensuring the policy is enforced. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/529 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/529 Fri, 21 Aug 2026 08:24:16 GMT The gateway authorized agent-scoped cron mutations against a job before entering the cron service's mutation lock. If the job was replaced with a different owner while the request waited, the old commit guard did not re-check the caller's live job scope, allowing `cron.scratch.set`, `cron.remove`, or `cron.run` to operate on the replacement job. The patch adds a commit guard that re-reads the caller scope and live job at commit time, rejecting operations when ownership or config revision changes. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/528 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/528 Fri, 21 Aug 2026 07:56:39 GMT Before the patch, non-interactive onboarding failure output directly emitted raw diagnostic fields (message, detail, diagnostics) without applying secret redaction. If a registered secret (e.g., gateway auth token) appeared in a probe error or daemon diagnostic, it would be exposed in JSON or human-readable output. The fix routes all output through redactSecrets to strip registered secrets while preserving diagnostic classification. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/527 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/527 Fri, 21 Aug 2026 06:24:30 GMT Scheduler-owned runs (cron, hooks, heartbeat) could inherit the ambient request context of an unrelated user request when they executed. This allowed a scheduled task to access another user's terminal sessions, dashboard, or client identity, leading to cross-user privilege escalation. The patch introduces a dedicated lifecycle-fenced Gateway context for scheduler-owned runs and explicitly prevents inheritance of any active request scope. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/524 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/524 Fri, 21 Aug 2026 05:47:53 GMT The offline `agents delete` path failed to remove exec approval policies, leaving stale allowlist entries that are reactivated if an agent with the same ID is recreated, granting unauthorized command execution. Additionally, the approval-removal helper used permissive normalization that treated the wildcard `"*"` as `"main"`, causing deletion of the main agent to also remove the global wildcard policy. The patch wraps offline deletion with the same approval-cleanup helper and uses strict normalization to preserve wildcard and unrelated policies. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/525 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/525 Fri, 21 Aug 2026 05:52:08 GMT The Telegram target writeback logic used a custom normalization that omitted the direct-message topic ID, causing direct-topic targets (e.g., @channel:direct-topic:77) to be matched with unthreaded targets for the same channel. This allowed an attacker who triggered a target resolution to overwrite unrelated configuration entries (such as the default broadcast target), redirecting future bot messages to a topic under the attacker's control. The patch correctly differentiates direct-topic targets and preserves the suffix in the resolved target. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/526 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/526 Fri, 21 Aug 2026 05:55:20 GMT The session replacement projection only compared the raw entry_json column during commit validation, but owner and participant data are stored outside that JSON blob. A concurrent ownership change could occur after the snapshot was read but before the write transaction, allowing a stale replacement from the previous owner to overwrite the new owner's session metadata and revert ownership. The patch captures the full resolved session row and compares both raw JSON bytes and logical session entry (including owner/participants) within the transaction. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/523 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/523 Fri, 21 Aug 2026 04:35:55 GMT Before the patch, an explicitly empty --agent value in 'openclaw approvals allowlist add' was silently treated as the wildcard agent '*', causing a dangerous command pattern to be approved for all agents. An operator using an unset environment variable (e.g., --agent "$AGENT") could unintentionally grant broad exec approval, bypassing per-agent security controls. The patch rejects blank agent values with an error before persisting any approval. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/522 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/522 Fri, 21 Aug 2026 04:01:26 GMT An unauthenticated remote attacker can trigger a nil pointer dereference panic in Vault's aliasNameFromLoginRequest by sending a malformed AppRole login request where secret_id is a JSON object instead of a string. The panic is caught per-connection by net/http, but it drops the connection and logs a stack trace, allowing repeated requests to cause denial of service through log flooding and CPU exhaustion. The patch adds nil checks for resp and resp.Auth before accessing resp.Auth.Alias. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/519 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/519 Fri, 21 Aug 2026 02:13:08 GMT When onboarding with `--secret-input-mode ref`, gateway credentials passed via `--gateway-password`, `--remote-token`, or `--remote-password` were written as literal plaintext strings into the OpenClaw configuration file instead of as environment SecretRefs. This violated the explicit guarantee of ref mode and left credentials exposed on disk. The patch replaces the plaintext password assignment with `createGatewayEnvSecretRef`, enforcing env-backed references for these credentials. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/520 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/520 Fri, 21 Aug 2026 02:15:22 GMT Before the patch, untrusted or restricted session content could be recorded in daily memory artifacts with an 'agent' (trusted) origin class due to incorrect provenance capture. When a memory provider was enabled later, background dreaming processes (narrative and consolidation) ran with tool access enabled, allowing attacker-controlled content to be interpreted as trusted and trigger tool calls, bypassing the tool ceiling applied to the original untrusted source. The patch preserves provenance and disables tools in dreaming phases. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/521 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/521 Fri, 21 Aug 2026 02:16:31 GMT Before the patch, running 'openclaw onboard --secret-input-mode ref' still generated a gateway token and wrote it as a plaintext string in openclaw.json, ignoring the operator's explicit choice to use secret references. Anyone with read access to the config file could obtain the gateway token and authenticate to the gateway. The patch fixes this by storing the token in the secret store or as an environment reference, keeping plaintext secrets out of the configuration. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/518 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/518 Fri, 21 Aug 2026 00:41:08 GMT Before the patch, identified non-admin Gateway users could access incognito sessions (which are documented as admin-only) through various entry points such as aliases, OpenAI-compatible HTTP routes, task or artifact identifiers, and task events. The session authorization check was missing or inconsistently applied before canonical session resolution, allowing unauthorized users to retrieve sensitive incognito session content. The patch adds a centralized authorization check after session resolution, requiring the admin scope for incognito sessions unless the requester is the owner. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/516 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/516 Thu, 20 Aug 2026 22:29:28 GMT Before the patch, JWT auth profiles created prior to the introduction of the profiles-by-issuer index had no entry under that path. The issuer->namespace map used for token revocation was therefore incomplete, causing silent lookup failures when attempting to revoke tokens for those issuers. This allowed tokens issued by such profiles to survive namespace deletion or other revocation events, retaining unauthorized access. The patch adds a migration at unseal to backfill missing index entries, restoring complete revocation coverage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/514 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/514 Thu, 20 Aug 2026 16:19:35 GMT The code before the patch failed to register several caches holding plugin callbacks, module exports, and native require entries with the plugin metadata lifecycle clear. As a result, a plugin that was uninstalled or replaced could leave its executable code cached and still be invoked later, allowing a removed malicious plugin to continue running and exfiltrating data. The patch registers these caches with the lifecycle clear seam so that old code is evicted when plugin metadata changes. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/515 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/515 Thu, 20 Aug 2026 16:25:00 GMT Before the patch, JWT tokens created via the OIDC/JWT auth method were not revoked in all namespaces when the associated profile (role) was deleted. This allowed an attacker who had previously authenticated to retain a valid Vault token after the role was removed, bypassing authorization. The patch ensures JWT tokens are correctly excluded from a legacy non-service token cleanup path that interfered with revocation, and adds revocation across all namespaces where the profile exists. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/511 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/511 Thu, 20 Aug 2026 15:26:57 GMT Keycloak did not verify signature on SAML LogoutResponse messages for clients that had 'requiresClientSignature' enabled. An attacker could forge an unsigned LogoutResponse and submit it via a cross-site POST to Keycloak's SAML endpoint, causing the authenticated user's session to be terminated. The patch adds signature verification and returns HTTP 400 for invalid signatures. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/512 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/512 Thu, 20 Aug 2026 15:27:41 GMT The NotBeforeCheck logic in TokenManager used Math.min(realmNotBefore, clientNotBefore), allowing a refresh token issued after an older realm notBefore but before a newer client notBefore to bypass client-level revocation. An attacker with such a refresh token could continue to obtain new access tokens for a client that should have been revoked. The patch uses Math.max so tokens must be issued after both revocation timestamps. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/510 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/510 Thu, 20 Aug 2026 15:22:16 GMT The code-mode alias reconciler ignored non-string or blank invalidations of one alias, allowing a hook or trusted policy to be bypassed by supplying both `code` and `command` fields. An attacker could get the policy to clear only one alias while the other retains the malicious script, causing Code Mode to execute the surviving alias despite the policy's attempt to block execution. The patch makes any explicit non-string/blank mutation dominate and mirror to both aliases, causing execution to fail closed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/513 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/513 Thu, 20 Aug 2026 15:32:19 GMT When 'core.multi_team' is enabled, calling Variable.set() with a team_name on an existing variable overwrote the variable's team ownership in the upsert ON CONFLICT DO UPDATE clause. This allowed a user from one team to hijack a global variable or a variable owned by another team, causing global or other-team lookups to fail (DoS) and unauthorized modification of variable ownership. The patch removes team_name from the update fields, preserving the existing owner. medium confirmed CVE-2026-68076 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/509 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/509 Thu, 20 Aug 2026 14:13:29 GMT Pushed Authorization Request (PAR) request_uri values were not bound to the realm or client that created them. This allowed a request_uri issued in one realm or for one client to be consumed by the authorization endpoint of another realm or client, potentially leading to cross-tenant authorization flow confusion or bypassing client-specific policies. The patch stores the realm ID in the cache key and the client ID in the PAR data, and validates them on retrieval. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/508 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/508 Thu, 20 Aug 2026 13:33:25 GMT Before the patch, the service account tokens API did not enforce admin-configured maximum token expiration settings (`auth.api_key_max_seconds_to_live` and `service_accounts.token_expiration_day_limit`). A user with permission to create service account tokens could create tokens with no expiration or longer lifetimes than allowed, bypassing organizational security policy. The patch adds validation in `handleCreate` to reject such requests. medium confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/507 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/507 Thu, 20 Aug 2026 11:01:14 GMT The Google identity provider can be configured with a hostedDomain restriction, but the external token exchange v1 flow did not enforce it. An attacker with a Google account outside the allowed domain could present a valid Google access token to the token-exchange endpoint and obtain a Keycloak identity, bypassing the domain allowlist. The patch validates the 'hd' claim from userinfo during external token exchange. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/506 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/506 Thu, 20 Aug 2026 10:58:56 GMT Before the patch, the gateway used the effective runtime configuration (params.nextConfig) as the activation source config and metadata snapshot config during plugin reload. This allowed synthesized runtime configuration from environment overrides or dynamic generation to be treated as authored trust policy, potentially causing untrusted plugins to be loaded with privileged gateway capabilities (trusted diagnostics, health, trace bridges). The patch separates the authored sourceConfig from the effective nextConfig and uses sourceConfig for trust decisions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/504 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/504 Thu, 20 Aug 2026 09:49:08 GMT Before the patch, a Keycloak Microsoft identity provider configured with a specific Entra tenant still accepted external OAuth tokens from any Microsoft tenant during token exchange, because the exchange validated the access token via Microsoft Graph without comparing the token's `tid` claim to the configured tenant. An attacker with a valid Microsoft account in another tenant could exchange their token and obtain a Keycloak session/access token, bypassing the IdP's tenant allowlist. The patch reads `tid` from the subject token and rejects it with `invalid_token` if the configured tenant is restricted and does not match. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/503 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/503 Thu, 20 Aug 2026 09:10:00 GMT The ResetCredentialEmail authenticator's action() method unconditionally called context.success(), allowing an attacker who has initiated a password reset to advance the flow to the password change form without clicking the emailed reset link. This enabled account takeover by resetting any user's password without access to their email. The patch adds validation that the current user matches the action token user ID, and also ties the 'try another way' selector note to a specific execution ID. critical confirmed CVE-2026-18963 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/502 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/502 Thu, 20 Aug 2026 02:49:19 GMT The active-memory plugin's `before_prompt_build` hook executed in the pre-policy phase, recalling and injecting memory context into the prompt even when the finalized tool policy for the turn disallowed memory access (`memory_search`). This bypasses the tool authorization boundary and can disclose private memory contents to the model and user. The patch moves the recall hook to a new post-policy phase with `requiresToolAuthority: true` and checks `toolAuthority.allows('memory_search')` before recalling. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/501 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/501 Thu, 20 Aug 2026 00:29:14 GMT The custom ViewerFailureLimiter used an anchored 60-second window and reset the failure count whenever the current time exceeded windowStartMs + 60s. An attacker could send 39 invalid viewer requests, wait 61 seconds, and repeat indefinitely without ever reaching the 40-failure threshold, effectively disabling brute-force protection. Additionally, when the limiter map reached 2048 entries, prune() cleared all state including active lockouts. The patch replaces it with a rolling-window canonical rate limiter that preserves lockouts. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/499 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/499 Wed, 19 Aug 2026 23:16:51 GMT Before the patch, the Gateway config.get response included a raw deterministic hash of the full config (configRevisionHash) and raw appliedConfigHash. Any client that can retrieve the redacted config could use these hashes as an oracle to brute-force redacted secret values. The patch replaces the raw hashes with installation-local HMAC tokens, preventing external parties from reproducing config digests. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/500 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/500 Wed, 19 Aug 2026 23:18:07 GMT Before the patch, the provisioning of the signed Computer Use service app did not verify that the target codex home and computer-use directory were within the agent's ownership root and not symbolic links. An attacker with control over one agent's directory could create a symlink pointing to another agent's directory or another sensitive location, causing the provisioning logic to write the native client bundle outside the intended isolation boundary, thereby breaking agent isolation and potentially overwriting files. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/497 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/497 Wed, 19 Aug 2026 20:50:31 GMT Before the patch, resolveFeishuToolAccount returned the configured defaultAccount without verifying that the account was enabled. An operator could disable a Feishu account to revoke its access, but model tools would still use its credentials and permissions. The patch checks the enabled status before returning the default account, skipping disabled accounts and selecting an enabled fallback or throwing an error. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/498 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/498 Wed, 19 Aug 2026 20:51:47 GMT MCP App operations performed an authorization check before awaiting catalog work, but did not revalidate the grant after the await. An attacker with a valid MCP App ticket could start a tool call or list operation, then have the granting widget revoked while the catalog request was pending, and the operation would still execute after revocation. The patch adds a revalidation step after the awaited catalog/list work and immediately before tool dispatch or capability return, blocking unauthorized actions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/496 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/496 Wed, 19 Aug 2026 20:24:51 GMT The SSF transmitter listener dereferences event.getDetails() without checking for null when processing logout events, causing a NullPointerException. This occurs during RP-initiated logout without a post_logout_redirect_uri, where details are not populated. The exception prevents the SSF listener from sending the required logout security event token (SET) to relying parties, thereby bypassing the session revocation notification mechanism. The patch adds null checks and treats missing details as a real logout / non-expiration. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/495 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/495 Wed, 19 Aug 2026 20:23:17 GMT Before the patch, caller-controlled voice call transcripts were included in the system prompt, giving untrusted speech system-level priority. This allowed a malicious caller to inject instructions that could override system safeguards, potentially causing the assistant to reveal sensitive information, ignore policies, or perform unauthorized actions. The patch moves raw transcripts to the user prompt with proper provenance, ensuring they are treated as untrusted user input. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/493 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/493 Wed, 19 Aug 2026 17:14:51 GMT Before the patch, canonicalizeBase64 appended each base64 character to a string, causing V8 to allocate one cons-string node per character. A remote attacker could send a large base64 attachment (e.g., 20 MiB) to POST /v1/responses, causing the gateway process to exhaust heap memory and crash, denying service. The patch replaces per-character concatenation with a single bounded output buffer, eliminating the unbounded transient heap allocation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/494 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/494 Wed, 19 Aug 2026 17:17:45 GMT The operator namespace HTTP access control was not enforced; sensitive sys endpoints (seal, unseal, step-down, etc.) were always registered under /v1/sys/ regardless of the configured operator namespace path. This allowed clients in non-operator namespaces to access these endpoints, bypassing the intended namespace isolation. The patch routes these endpoints under the operator namespace prefix, enforcing the isolation. high confirmed CVE-2026-12624 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/492 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/492 Wed, 19 Aug 2026 15:54:36 GMT The authorization evaluator for alert rules skipped datasource query permission checks for any query with QueryType equal to expr.DatasourceType, regardless of the actual DatasourceUID. An attacker who can create or modify alert rules but lacks query permission on a target datasource could set QueryType to 'expression' while setting DatasourceUID to a real datasource UID, bypassing authorization and querying the datasource at evaluation time. The patch removes the QueryType check and only skips queries whose DatasourceUID is the built-in expression datasource UID. Patch landed 2 hours 44 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/491 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/491 Wed, 19 Aug 2026 14:05:47 GMT The JavaKeystoreKeyProviderFactory validation did not normalize the resolved keystore path before checking that it stayed within the realm directory. An attacker with permission to create a key provider could specify a keystore path containing '../' to escape the intended directory and load a keystore file from elsewhere on the server filesystem. The patch normalizes both the realm directory and final keystore path before the startsWith check. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/490 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/490 Wed, 19 Aug 2026 14:03:11 GMT Before the patch, the private-network guard (isPrivateOrLoopbackIpAddress) did not classify RFC 8215 local-use NAT64 IPv6 literals (64:ff9b:1::/48) as private, and did not extract embedded IPv4 addresses to check for private ranges. This allowed an attacker to craft an IPv6 literal in that prefix embedding an internal IPv4 address (e.g., 10.0.0.1 or 169.254.169.254) that bypassed SSRF filters. The patch adds explicit detection of local-use NAT64 as blocked special-use and falls back to extracting embedded IPv4 to classify private IPv4-based IPv6 addresses. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/489 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/489 Wed, 19 Aug 2026 13:18:27 GMT The Mattermost ingress debouncer combined messages from different senders into a single inbound turn, allowing a denied user's message to be processed under an allowed user's identity. Additionally, authorless posts fell back to using broadcast metadata as sender ID. The patch separates debounce lanes per sender and requires an explicit post author. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/488 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/488 Wed, 19 Aug 2026 11:59:05 GMT Before the patch, the browser node proxy separately persisted files and applied path mappings. If a browser node returned a result referencing a file not included in the file envelope, the result path was left unvalidated and could contain arbitrary filesystem paths. A malicious or compromised node could return a path like '../../../../etc/passwd', which the Gateway might later serve, leading to arbitrary file read. The patch consolidates validation, persistence, and path rewriting into a single fail-closed operation that rejects missing, duplicate, or unreferenced file payloads. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/487 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/487 Wed, 19 Aug 2026 11:37:14 GMT The vulnerable code consumed the pending Discord speaker context after awaiting an asynchronous active-run control. Concurrent final transcripts could update the pending context during that await, causing a non-owner's transcript to be attributed the owner's senderIsOwner=true context. This allowed a non-owner user's voice command to execute with owner-level permissions. The patch captures the fallback talkback speaker context before the await, preventing the race. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/486 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/486 Wed, 19 Aug 2026 10:44:22 GMT Before the patch, the webhook authentication rate limiter keyed on req.socket.remoteAddress, which is the proxy IP when behind a reverse proxy. An attacker could send invalid signed requests through the proxy to exhaust the shared rate limit, causing legitimate clients behind the same proxy to be rejected with 429 errors before signature verification. The patch uses trusted-proxy client attribution to isolate rate limits per forwarded client IP. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/485 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/485 Wed, 19 Aug 2026 10:03:44 GMT The DELETE endpoints for asset queued events authorized the DAG axis with requires_access_dag(method="GET"), a read-level check, while performing a write operation that cancels a DAG's pending asset-triggered scheduling. A user with only read permission on a DAG but delete permission on the global Assets resource could delete queued events, suppressing that DAG's asset-triggered runs. The patch changes the DAG axis to require edit (PUT), preventing unauthorized writes to DAG scheduling state. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/481 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/481 Wed, 19 Aug 2026 09:00:42 GMT Before the patch, Skill Workshop apply/reject requests did not include the reviewed revision hash. This allowed a race condition where an attacker could modify a proposal after an operator reviewed it but before the operator's decision was submitted, causing the decision to apply to a different, unreviewed revision. The patch binds every decision to the exact reviewed revision through an expectedRevisionHash and rejects stale decisions with SKILL_PROPOSAL_REVISION_CHANGED. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/482 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/482 Wed, 19 Aug 2026 09:03:16 GMT The tool factory used the sandbox/policy key (agentSessionKey) instead of the caller's durable run session key when resolving the caller agent and constructing session lookup tools. In multi-agent deployments, this could cause session list/search/history requests to be issued under an ownerless 'global' policy identity, potentially bypassing per-agent authorization and leaking other agents' session data. The patch switches to runSessionKey (with fallback to agentSessionKey) to ensure the originating agent's identity is used for scoping. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/483 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/483 Wed, 19 Aug 2026 09:04:19 GMT Before the patch, any authenticated Gateway user could call users.setGitHubIdentity to claim any GitHub username without proving ownership of the GitHub account. This allowed an attacker to set their profile's GitHub identity to a victim's username, causing commits created from their sessions to include a forged Co-authored-by trailer for the victim. The patch removes the mutating methods and derives GitHub identity only from authenticated sign-in, binding it to the verified numeric GitHub account id. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/484 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/484 Wed, 19 Aug 2026 09:05:45 GMT The node_process tool was mislabeled as controlling remote-node background sessions, but it actually operated on the Gateway-local process registry. This allowed an attacker with permission to use node_process (but not gateway_process) to enumerate or kill Gateway background processes, bypassing the intended policy separation between remote node and Gateway execution. The patch removes the node_process tool entirely, eliminating the mislabeled tool that could cause cross-session interference or policy violation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/480 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/480 Wed, 19 Aug 2026 07:13:18 GMT The patch fixes a vulnerability where an explicitly configured but policy-blocked SearXNG base-URL SecretRef was treated as missing, causing fallback to the ambient SEARXNG_BASE_URL environment variable and bypassing the provider/env allowlist. This could allow unauthorized use of a SearXNG instance or enable SSRF to internal resources. The patch introduces tri-state read-only resolution that distinguishes blocked from missing, and only falls back when the SecretRef is genuinely absent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/479 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/479 Wed, 19 Aug 2026 05:55:16 GMT Before the patch, `authorizeControlUiReadRequest` fell back to device-token authentication when shared-secret auth failed, but after validating the device token it returned true immediately without enforcing the required operator scope (e.g., `assistant.media.get` or `operator.read`). This allowed a paired device token with no relevant scopes to access read-only Control UI endpoints such as assistant media, workspace icons, or channel avatars. The patch replaces this custom logic with `authorizeControlUiReadRequestOrReply`, which carries verified scopes through the authorizer and enforces the required scope for all auth methods. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/478 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/478 Wed, 19 Aug 2026 05:00:09 GMT The force parameter in the worktree removal API was overloaded to bypass not only snapshot-loss protection but also live-run lease and foreign Git lock checks. A user with permission to remove worktrees could set force:true to delete another user's active worktree, causing denial of service and loss of uncommitted changes. The patch separates snapshot-loss consent (allowSnapshotLoss) from lifecycle authority, making lease and lock checks unconditional. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/477 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/477 Wed, 19 Aug 2026 02:52:17 GMT Before the patch, when an agent run completed with an authoritative silent or empty terminal reply, the waiting code would ignore that terminal reply and fall back to reading the latest assistant message from the session transcript. This could resurrect private or sensitive content from earlier assistant turns that the agent intended not to expose as final output, leading to unauthorized disclosure of private transcript text. The patch ensures that any present terminal reply (visible, silent, or empty) is treated as authoritative, preventing transcript fallback and the associated information leak. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/476 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/476 Wed, 19 Aug 2026 02:02:51 GMT Beam mirror upload code followed HTTP redirects when sending session snapshots to a configured endpoint. An attacker who could induce a 307/308 redirect (e.g., via an open redirect on the receiver or a compromised receiver) could cause the POST body containing sensitive coding session content to be replayed to an arbitrary internal or attacker-controlled URL, bypassing SSRF guards. The patch stops redirect following and treats redirect responses as terminal, preventing the replay. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/475 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/475 Wed, 19 Aug 2026 00:27:25 GMT The gateway tool denial list did not normalize tool names, so aliases like 'cron' did not match the canonical tool name 'automations'. This allowed a tool to be invoked even when explicitly denied in the gateway configuration. The patch normalizes both the deny set and tool names, ensuring deny rules are enforced across aliases. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/474 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/474 Tue, 18 Aug 2026 23:39:09 GMT Before the patch, the Codex approval bridge allowed operators to grant persistent ('allow-always') approval for command executions even when the native Codex request only supported one-shot ('accept') approval. This caused the Gateway to store an allow-always decision for actions that should have been one-shot, enabling subsequent executions of the same command without further operator approval. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/473 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/473 Tue, 18 Aug 2026 22:58:16 GMT The commit fixes a policy bypass where sender-scoped file read restrictions (toolsBySender deny rules) were not enforced on outbound file attachments, especially when the message action targeted a different channel. Attackers could prompt the agent to attach local files (e.g., workspace secrets) to messages sent to another channel, causing the policy resolver to use the target channel's provider instead of the original sender's, thereby bypassing denial. The patch ensures the correct sessionKey and requester identity are used to resolve sender policy for outbound media. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/472 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/472 Tue, 18 Aug 2026 22:09:07 GMT The UI used all discovered skills as the base when toggling a skill for an agent with inherited allowlist, leading to an explicit override that enabled all skills, bypassing the inherited restrictions. The patch uses the effective inherited filter as the base, preventing unintended privilege escalation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/471 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/471 Tue, 18 Aug 2026 21:00:11 GMT Keycloak Admin API endpoints for retrieving composite roles did not enforce FGAP view permissions on child roles. An administrator with permission to view a parent role could enumerate all composite roles, including roles they were not authorized to view, leaking role names and IDs. The patch adds filtering by auth.roles().canView() to the relevant composite retrieval methods. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/470 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/470 Tue, 18 Aug 2026 20:59:25 GMT The 'openclaw channels logs' command read the gateway log file directly and printed raw log lines without applying secret redaction. This allowed sensitive values present in the log file (e.g., credentials, tokens, secrets) to be exposed in CLI output. The patch routes the command through the canonical log-tail reader that applies pattern redaction and the registered-secret registry, preventing credential leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/469 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/469 Tue, 18 Aug 2026 20:37:43 GMT In Keycloak with fine-grained admin permissions v2 enabled, endpoints for user/group role mappings failed to verify that the caller has view permission on the client or role. As a result, an admin with view permission on a user or group could query role mappings for any client and receive role representations (names, IDs, attributes) for clients they were not authorized to view. The patch adds auth.roles().requireView(client) and filters role mapping streams based on role container permissions. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/468 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/468 Tue, 18 Aug 2026 19:55:34 GMT When Fine-Grained Admin Permissions (FGAP) were enabled, the in-memory client listing implementation incorrectly set 'canView' to true for all users with the list permission, bypassing per-client authorization checks. This allowed any user with list permission to retrieve all clients in the realm, even if they lacked view permission on specific clients. The patch removes the in-memory listing path and requires the SCIM backend, which enforces proper FGAP filtering. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/467 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/467 Tue, 18 Aug 2026 19:15:05 GMT Classic inbound voice callers were not explicitly marked as non-owners before the embedded agent invocation. The agent runtime defaults to owner privileges when senderIsOwner is undefined, allowing external callers to invoke owner-only control-plane tools. The patch passes senderIsOwner: false for inbound calls and undefined for outbound delegated calls. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/466 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/466 Tue, 18 Aug 2026 18:36:33 GMT The OAuth strategy config loading accessed a shared ini.File concurrently without synchronization. Under concurrent OAuth login requests or settings refreshes, the ini library's internal map is read and written simultaneously, causing a fatal 'concurrent map read and map write' panic that crashes Grafana. The patch replaces direct ini.File access with GetSections() that returns a private copy, eliminating the race. Patch landed 5 days 21 hours 4 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/465 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/465 Tue, 18 Aug 2026 18:01:50 GMT The GET /api/v2/assets/events endpoint returned AssetEvent rows for all Dags without enforcing per-Dag authorization, relying only on the global 'Assets' resource check. A user with read access to only one Dag and global asset read could retrieve event details (source Dag, task, run identifiers, and task-authored 'extra' payloads) from other Dags. The patch adds PermittedAssetEventFilter to scope events to the Dags the caller may read, while keeping events with no source Dag visible. high confirmed CVE-2026-68971 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/464 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/464 Tue, 18 Aug 2026 17:48:18 GMT Before the patch, Azure AD id_tokens were decoded with only signature verification against Microsoft's common multi-tenant key set. The token's issuer and audience were not enforced, so any correctly signed token from any Azure AD tenant could be accepted by the Airflow OAuth login. This allowed an attacker to log in as an arbitrary user or gain admin roles if the token contained forged roles, leading to authentication bypass and potential privilege escalation. The patch pins the iss claim to the configured tenant and the aud claim to the application's client_id, and rejects configurations that do not identify a single tenant. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/463 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/463 Tue, 18 Aug 2026 17:44:33 GMT Before the patch, gateway session create/fork/recover handlers did not correctly enforce session participation boundaries for multi-profile operators with write scope. An operator could apply lifecycle operations (e.g., fork/recover) to a session they were not a participant in, copying its transcript or reusing its data. The patch adds method-specific protocol target extraction and revalidates participation inside the SQLite commit transactions via commitGuard, returning SESSION_PARTICIPATION_REQUIRED. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/462 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/462 Tue, 18 Aug 2026 17:16:59 GMT The OIDC provider UI route directly redirected unauthenticated users to the 'redirect_uri' query parameter when 'prompt=none' was specified. Since 'redirect_uri' was not validated, an attacker could craft a link that redirects victims to an arbitrary external site, enabling phishing or credential theft scenarios. The patch removes this direct client-side redirect and routes unauthenticated users through the standard Vault auth flow instead. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/460 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/460 Tue, 18 Aug 2026 16:23:18 GMT In unified storage Mode5, the bulk team permission endpoint did not redirect team membership writes to Team.Spec.Members; it only updated K8s ResourcePermission objects and skipped the actual membership store. Removing a user from a team via this endpoint left the user as a team member, preserving their team-based access to dashboards, folders, and other resources. The patch routes bulk team permission changes through the same membership redirect used for single-user updates, ensuring removals are reflected in Team.Spec.Members. Patch landed 13 days 5 hours 25 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/461 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/461 Tue, 18 Aug 2026 16:24:40 GMT Before the patch, the redactSecrets function only redacted secret fields at the top level of SSOSetting settings, leaving nested LDAP secrets such as bind_password under config.servers\[\] exposed in API responses. An attacker with read access to the SSOSetting API could retrieve plaintext LDAP bind passwords. The patch adds recursive redaction for nested LDAP server maps, preventing this leak. Patch landed 13 days 5 hours 35 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/458 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/458 Tue, 18 Aug 2026 15:56:00 GMT The `config get` command previously failed to redact plugin-schema-defined secrets and structured SecretRef identifiers, allowing operators to expose sensitive values. The patch ensures redaction uses the exact config snapshot and plugin metadata, and fails closed if metadata is unavailable, preventing secret leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/455 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/455 Tue, 18 Aug 2026 14:51:14 GMT Before this patch, the steering logic could inject a message into any active embedded agent run by looking it up with a raw session ID, without verifying that the caller's tool authority matched the session's tool authority. This allowed an authenticated attacker to steer another user's session and execute arbitrary instructions under the victim agent's identity. The patch removes the raw session-id path and requires tool-authority equality for /steer and gateway injection. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/454 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/454 Tue, 18 Aug 2026 13:26:02 GMT The admin UI extension endpoints returned composite role mappings without checking whether the caller had VIEW permission on each composite role. This allowed users with limited administrative permissions to enumerate hidden roles and clients they were not authorized to view. The patch filters roles with auth.roles().canView() before returning them. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/453 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/453 Tue, 18 Aug 2026 10:54:01 GMT The streaming TTS path passed raw assistant reply text directly to TTS providers without applying speech-text normalization, causing raw Markdown link destinations (including sensitive tokens) to be spoken aloud. This allowed other users in a Discord voice channel to hear secret URLs (e.g., password reset links) that should have been redacted. The patch normalizes the text before streaming synthesis, stripping raw link destinations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/452 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/452 Tue, 18 Aug 2026 10:20:14 GMT Before the patch, Keycloak's 'Sign out of other devices' on credential reset only invalidated completed user sessions, leaving in-progress authentication sessions where a user had already authenticated with the old password. An attacker could have initiated authentication before the reset and then completed the remaining steps afterward to obtain a valid session. The patch adds removal of these in-progress root authentication sessions for the user, except the current reset session. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/451 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/451 Tue, 18 Aug 2026 10:00:49 GMT The SecureClientUrisExecutor policy validates that client URI fields use secure schemes (e.g., HTTPS). Prior to this commit, the OIDC front-channel logout URL (frontchannel_logout_uri) was omitted from validation, allowing clients subject to the policy to register a malicious URI such as javascript:alert(document.cookie). When a user logs out, Keycloak renders the front-channel logout URL in an iframe, leading to XSS on the Keycloak origin. The patch adds the field to both the executor and pattern executor, ensuring it is validated. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/450 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/450 Tue, 18 Aug 2026 09:58:13 GMT Before the patch, Skill Workshop collection review could rewrite or delete any skill file located in a writable workspace directory, including user-authored or repository-owned skills, because no ownership verification was performed. An attacker who could influence the autonomous review (e.g., via prompt injection in a malicious skill) could cause arbitrary skill files to be overwritten or dropped, leading to data loss and potential code execution when the overwritten skill is later used. The patch restricts mutations to skills with an applied Workshop create proposal, blocking unauthorized changes to external skills. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/448 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/448 Tue, 18 Aug 2026 08:59:44 GMT Before the patch, when an OpenClaw session executed in a folder outside the configured agent workspace, it loaded identity files (AGENTS.md, SOUL.md, IDENTITY.md, USER.md, MEMORY.md) from the execution folder. An attacker-controlled repository could contain malicious versions of these files, allowing prompt injection to override the agent's core identity and instructions. The patch sources agent identity from the configured workspace and only layers execution-directory AGENTS.md as downstream project context. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/449 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/449 Tue, 18 Aug 2026 09:02:26 GMT Before the patch, regenerating a client's registration access token through the admin API caused the live bearer token to be stored in the admin event representation. Any user with permission to view admin events (e.g., the 'view-events' realm role) could retrieve this token and use it to access the OIDC Client Registration endpoint, gaining unauthorized control over the client configuration. The patch masks the registration access token in stripClient() and ensures the admin event receives the masked value while the API response still contains the real token. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/446 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/446 Tue, 18 Aug 2026 08:20:26 GMT The ACP approval classifier auto-approves readonly reads only when the resolved path stays within the current working directory. Before the patch, only lowercase `file://` URLs were converted to filesystem paths; alternate valid file URL forms like `file:/outside` or `FILE:///outside` were treated as relative paths and resolved inside cwd, so the permission check passed. A malicious tool call could request `file:/etc/passwd` and receive automatic approval, allowing arbitrary local file reads outside the intended approval boundary. The patch normalizes all file-scheme spellings with `trySafeFileURLToPath` and fails closed when conversion fails. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/447 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/447 Tue, 18 Aug 2026 08:23:58 GMT Before the patch, client attributes ending with 'private.key' were included unmasked in admin events generated during client create/update/import. An attacker with view-events permission (but not manage-clients) could retrieve these events and obtain private keys of clients, enabling impersonation or token forgery. The patch masks these attributes in admin events. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/445 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/445 Tue, 18 Aug 2026 05:21:49 GMT The patch fixes a security boundary bypass where the `allowedDomains` restriction configured for Codex native hosted search was not enforced on the managed `web_fetch` tool. Before the patch, an attacker controlling the model could use `web_fetch` to request arbitrary URLs, including internal services and cloud metadata endpoints, bypassing the intended domain allowlist. The patch propagates the allowlist into the `web_fetch` tool configuration when native hosted search is active, ensuring it honors the same domain policy. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/444 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/444 Tue, 18 Aug 2026 04:50:37 GMT The MCP diagnostic redaction only partially masked secrets in error messages, leaving a prefix and/or suffix visible. This could leak portions of API keys, bearer tokens, or other sensitive data to anyone with access to logs or diagnostics. The patch replaces this partial masking with full asterisk masking, ensuring no secret characters are exposed. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/443 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/443 Tue, 18 Aug 2026 04:05:14 GMT Before the patch, agent requests with attachments that were later rejected (e.g., due to an invalid channel) left staged files in media/inbound permanently. An attacker could repeatedly send such requests with large attachments to fill the disk and crash the service. The patch adds explicit cleanup of prepared inbound media on rejection and bounds outbound staging retention. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/442 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/442 Tue, 18 Aug 2026 02:47:45 GMT The voice-call CLI operational error formatter directly interpolated connectionDetails.url, which could include credentials in userinfo or query parameters (e.g., ws://user:pass@host). This caused gateway credentials to be printed in terminal error messages when CLI commands failed. The patch applies the canonical net-policy redactor to URLs before composing error messages, preventing credential leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/437 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/437 Tue, 18 Aug 2026 01:58:21 GMT Before the patch, Gateway hot reload did not refresh the hook target-policy snapshot when agent roster, ownership, session store/scope changed. An attacker with a previously valid direct-hook token for a removed agent could continue to invoke that agent's hooks after revocation, because the stale snapshot still considered the agent valid until a full restart. The patch adds these config paths to the reload plan and refreshes the policy snapshot without invalidating transform modules. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/438 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/438 Tue, 18 Aug 2026 02:01:51 GMT The Matrix channel normalized complete user IDs to lowercase for allowlist and authorization checks, causing accounts that differ only by case or Unicode case folding to be treated as identical. An attacker could register a Matrix account with the same localpart but different case (e.g., @alice:example.org vs @Alice:Example.org) and be authorized as the allowed user. The patch removes case folding for complete user IDs, making comparisons exact. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/439 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/439 Tue, 18 Aug 2026 02:03:05 GMT Before the patch, an agent could use the generic Nodes tool `invoke` action to call commands owned by node-published agent tools, bypassing the allow/deny policy enforced by those dedicated tools. For example, a denied command like `remote.secret` could be invoked directly through `node.invoke` without checking if a node-published tool exists for it. The patch centralizes node-invoke calls and rejects commands matching node-published tools or reserved dedicated commands unless invoked through their policy-filtered tool surface. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/441 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/441 Tue, 18 Aug 2026 02:10:49 GMT Before the patch, malformed --provider-env entries caused CLI parse errors to echo the full user-provided string, which could contain secrets (e.g., an API key passed as the value). Additionally, --provider-env was not included in the argv redaction set for config audit logs, so valid KEY=VALUE assignments were persisted with credentials in plaintext. The patch replaces error messages with fixed strings and adds --provider-env to the redaction list. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/435 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/435 Mon, 17 Aug 2026 23:35:03 GMT Classic onboarding printed a reusable Gateway token inside a dashboard URL (e.g., http://127.0.0.1:18789#token=<token>). This token-bearing output could be captured in terminal transcripts, logs, screen recordings, or support bundles, allowing an attacker who obtains such artifacts to authenticate to the Control UI and potentially control the system. The patch removes the authenticated URL builder and related token-specific output, printing only uncredentialed URLs and recovery commands. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/436 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/436 Mon, 17 Aug 2026 23:36:45 GMT Before the patch, when the bot's own username was unknown (pre-identity), any Telegram command targeted at a different bot (e.g., '/queue@OtherBot') was treated as a command for this bot due to permissive parsing in resolveTelegramCommandAliasForControlLane. This allowed an attacker to trigger control commands, potentially causing unauthorized actions. The patch restricts pre-identity command acceptance to only canonical abort commands. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/434 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/434 Mon, 17 Aug 2026 22:57:18 GMT When a structured attachment contained multiple media source fields (e.g., 'media' and 'path'), the normalization function only validated the first source due to a break statement in the collection loop. An attacker could supply a valid primary source inside the sandbox and a malicious secondary source outside the sandbox. The secondary source would bypass sandbox validation and could later be consumed by channel delivery, enabling arbitrary file read outside the sandbox. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/433 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/433 Mon, 17 Aug 2026 22:39:00 GMT The example_dms system test DAG created an AWS RDS PostgreSQL instance with PubliclyAccessible=True and a security group allowing inbound TCP 5432 from 0.0.0.0/0, while using hardcoded credentials (username 'username', password 'rds_password'). An attacker could connect to the database over the internet and read or modify data. The patch sets PubliclyAccessible=False, scopes ingress to the VPC CIDR, and optionally uses provided private subnet groups. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/432 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/432 Mon, 17 Aug 2026 21:57:04 GMT In Talk voice-only sessions, the `talk.client.toolCall` entry point dispatched embedded agent consults via `handleChatSend` without limiting the tool set to the caller's scopes. A session with only `operator.talk` (read-only) could therefore invoke state-changing owner tools (e.g., file writes or command execution) available to the embedded agent. The patch resolves authority from authenticated scopes and passes a restricted `toolsAllow` list to chat dispatch. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/428 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/428 Mon, 17 Aug 2026 21:37:11 GMT Before the patch, generateSlugViaLLM called runEmbeddedAgent with user-controlled sessionContent without disabling tools or providing an empty tool allowlist. This allowed prompt injection in the transcript to cause the model to invoke the agent's normal tools, potentially leading to arbitrary command execution or data exfiltration. The fix sets disableTools: true and toolsAllow: \[\] to ensure the slug generation helper cannot access any tools. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/429 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/429 Mon, 17 Aug 2026 21:37:52 GMT Before the patch, memory tools captured configuration at creation time and would fall back to that if the live configuration was unavailable or memory was disabled. This allowed agents to continue accessing memory (read, write, delete) after an operator disabled memory for the agent via a hot configuration update. The patch revalidates the live configuration at execution time and throws an error if memory is disabled, enforcing revocation. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/430 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/430 Mon, 17 Aug 2026 21:38:41 GMT Before the patch, the Parallel web search provider included unredacted error response bodies (or statusText) in thrown errors. If the external endpoint or an intermediate proxy reflected request headers, the operator's x-api-key could be leaked into user-facing error messages, exposing a secret credential to end users. The patch redacts sensitive text in two passes to mask the API key and any configured credential patterns. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/431 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/431 Mon, 17 Aug 2026 21:39:33 GMT The tar archive safety preflight ignored output truncation from 'tar tf'/'tar tvf', allowing an attacker to pad an archive with many entries so that a malicious path-traversal entry is hidden from the safety check while still being extracted. The patch fails closed when listing output is truncated and rejects unknown tar entry types, preventing extraction based on an incomplete manifest. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/427 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/427 Mon, 17 Aug 2026 21:01:24 GMT Before the patch, team names allowed uppercase letters and double underscores. The secrets backend upper-cases team names to build environment variable names for team-scoped secrets, causing teams whose names differ only by case to resolve to the same namespace and share secrets. An attacker who can create a team can choose a name like 'Data_Eng' to read the Connections and Variables of the existing team 'data_eng'. high confirmed CVE-2026-68076 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/426 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/426 Mon, 17 Aug 2026 19:45:12 GMT The workflow event providers matched role events by bare role name, failing to distinguish realm roles from client roles. An attacker with permission to manage client roles could create a client role with the same name as a realm role used in a workflow, then grant that client role to a user, causing the workflow to execute and potentially escalate privileges. The patch resolves the expected role based on realm or client and compares role IDs. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/424 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/424 Mon, 17 Aug 2026 19:17:02 GMT The workflow event provider compared the configured group path string directly against the group path generated by KeycloakModelUtils.buildGroupPath(). A group name containing a slash (e.g., 'Parent/Child') produces the same path as a nested group structure, causing workflows intended for nested groups to trigger for slash-named top-level groups. An attacker with permission to create and join groups could trigger admin-configured workflows (e.g., granting attributes or roles) without being in the intended nested group. The patch resolves the configured path to an exact group ID using findGroupByPath(), eliminating the path collision. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/425 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/425 Mon, 17 Aug 2026 19:20:21 GMT The normalizeOAuthJwtToId function extracted a unique identifier (such as 'jti') from JWT claims without verifying the JWT signature. An attacker could forge a JWT with a victim's token ID as the jti and use it to look up, renew, or revoke token entries. The patch replaces it with normalizeJwtForLookup, which validates the JWT and returns an error for invalid tokens. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/423 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/423 Fri, 14 Aug 2026 16:12:07 GMT The MT-Settings backed SSOSetting store returned plaintext secret values (client_secret, private_key, certificate, password, client_key) in API responses for Get/Create/Update operations, since the settings service decrypts secrets on read and the store echoed them unredacted. This deviates from the legacy /api/v1/sso-settings contract which redacts secrets, exposing sensitive OAuth/SAML credentials to any caller with read access to the SSOSetting API. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/422 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/422 Fri, 14 Aug 2026 15:27:32 GMT During partial realm import, client representations were persisted without validating the baseUrl (and other client URI fields) against allowed URI schemes, unlike full realm import and single client creation which already enforced this check. This allowed an administrator or an imported realm/config file to create a client with a baseUrl using the 'javascript:' scheme, which could later be rendered/executed in the context of the admin console or client application, leading to stored XSS or client-side script execution. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/421 Fri, 14 Aug 2026 08:35:19 GMT The shared approval-account selection logic's sole-account fallback did not check whether the approval request's originating channel (turnSourceChannel) matched the candidate channel, allowing an exec approval prompt originating from one channel (e.g., WhatsApp/Slack) to be delivered to a completely different, unrelated channel (e.g., Telegram) when that channel happened to be the only eligible account. This could expose sensitive command approval prompts (including command content) to unintended recipients on a foreign channel. The patch adds a check that rejects the fallback when the turnSourceChannel differs from the target channel, while still respecting explicit recorded bindings or forwarding targets. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/420 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/420 Fri, 14 Aug 2026 04:27:26 GMT On multi-identity Gateways, session-catalog visibility filtering compared the caller's profileId against a host row's createdActor.id, but for unauthenticated-profile callers (token/password auth) and unadopted host rows, both values were undefined. The optional-value equality check treated undefined === undefined as a match, causing the filter to fail-open and expose other users' host session metadata and transcripts to a caller with no profile at all. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/417 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/417 Thu, 13 Aug 2026 10:44:49 GMT The trash search endpoint returned Bleve's unfiltered match count as TotalHits whenever the requested page filled before the authorization scan was exhausted. Because that count included deletions belonging to other users (not just the caller's own), a low-privileged user with just one deletion of their own could vary title/field filters and infer, via the returned total, how many other users' deletions matched a given filter — leaking information about resources they are not authorized to see, even though marking the total 'inexact' did not prevent this reliable signal. Patch landed 18 days 11 hours 46 minutes before CVE-2026-19197 was published. medium confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/415 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/415 Thu, 13 Aug 2026 02:43:54 GMT The compaction safeguard's error log for corrective generation failures included the raw exception message via formatErrorMessage(attemptError), which could contain arbitrary internal data such as user session text, API details, or other sensitive content embedded in the underlying error. The patch redacts this by replacing the full exception text with a generic reason code and attempt number, preventing sensitive data from leaking into logs. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/416 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/416 Thu, 13 Aug 2026 02:44:41 GMT The Reef relay client passed relay-controlled error messages (from HTTP JSON error bodies and WebSocket close reasons) directly to callers/diagnostics without redacting credentials. Since a malicious or misbehaving relay could reflect the request's Authorization bearer token, setup token, request signature, or WebSocket signature back in the error message, these secrets could be surfaced in logs, UI, or telemetry. The patch strips known request secrets (tokens, sessions, signatures) from relay error text and WebSocket close reasons before applying a general redactor. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/414 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/414 Wed, 12 Aug 2026 15:36:29 GMT The trash search path used the ordinary read-access check for authorizing per-item visibility of deleted objects, instead of the stricter trash rule (folder-admin or the user who deleted the item) applied by the list path. Since read access to a folder is commonly granted to many users, any user with read access to a folder could see deleted (trashed) objects belonging to other users within that folder via the search API, even though they were not the deleter or a folder admin. Patch landed 19 days 6 hours 25 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/413 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/413 Wed, 12 Aug 2026 13:41:20 GMT Before the patch, sending a message or reading history for an explicit session key that did not exist would silently treat the target as an empty/newly-created session rather than rejecting the request. This allowed callers to implicitly create or interact with sessions that should not exist and could be used as an oracle to infer whether a specific (potentially otherwise inaccessible) session key exists, undermining the session visibility/authorization boundary. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/412 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/412 Tue, 11 Aug 2026 21:45:50 GMT The SCIM user extension attribute writer did not check whether an attribute was read-only (i.e., not permitted for editing) according to the User Profile configuration before writing its value to the user model. This allowed SCIM PATCH/PUT requests to modify custom user-profile attributes that were configured as view-only (no edit permission), bypassing the access-control restrictions enforced elsewhere (e.g., via the Admin REST API or UserProfile-based update logic). medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/411 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/411 Tue, 11 Aug 2026 21:45:37 GMT The SCIM UserResourceTypeProvider echoed the client-supplied request payload back as the response after create/update, rather than reflecting the actual persisted model state. Because the user-profile permission system can silently reject writes to protected attributes (e.g., admin-managed attributes) without failing the request, the SCIM response would still show the attacker-supplied value as if it were saved, even though the underlying UserModel retained the original (admin-set) value. This allows an attacker with SCIM write access to attributes that they don't have edit permission for to observe/believe their write succeeded (misleading response), and more importantly, any client trusting the SCIM response for authorization or display could be misled about which value is actually in effect, creating confusion and potential for further attacks relying on the mismatch (e.g., cached incorrect state, downstream logic decisions based on the wrong value). medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/410 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/410 Tue, 11 Aug 2026 19:18:32 GMT The SCIM filter predicate evaluator allowed filtering Users by 'groups.value' and Groups by 'members.value' without checking whether the caller has FGAP (Fine-Grained Admin Permissions) view authorization on the referenced group/user. This let an admin with restricted group/user visibility use SCIM filter queries (eq, co, sw, pr, ne, etc.) to infer membership in groups or users they are not authorized to view, bypassing the FGAP access model and leaking relationship data as an oracle. The patch adds an authorization callback that verifies VIEW permission on the target group/user before allowing the predicate, and blocks unsafe operators (only 'eq' with a verified target is allowed) as well as NOT-wrapping of authorized predicates to prevent inversion into a membership-leaking oracle. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/409 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/409 Tue, 11 Aug 2026 18:05:17 GMT The SCIM Users API's `groups` attribute exposed organization groups and the organization's internal backing group to callers holding only `view-users`/`manage-users` permissions, bypassing the intended boundary that restricts organization-related groups to the Organization API. This leaked organization membership and group metadata that should not be accessible via SCIM, violating the isolation enforced elsewhere (e.g. the SCIM Groups resource and the SCIM user write path). medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/408 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/408 Tue, 11 Aug 2026 18:04:21 GMT Both the chrome-mcp accessibility snapshot builder and the CDP renderRoleTree function recursively walked the accessibility tree without an enforced depth limit. A malicious or pathologically-nested web page (e.g., tens of thousands of nested DOM elements) could cause the recursive traversal to overflow the call stack (RangeError: Maximum call stack size exceeded), crashing the browser automation/gateway process, or generate quadratically growing indentation output (hundreds of MB) before any truncation logic runs, exhausting memory. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/407 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/407 Tue, 11 Aug 2026 16:11:36 GMT Before the patch, the SSF emit endpoint persisted the verbatim caller-supplied event payload (request.getEvent()) into the admin audit event log without sanitization, allowing arbitrary free-form fields and PII (e.g. email addresses, custom sensitive attributes, reason_admin/reason_user localized messages) supplied by a management client to be stored in the admin event store. This could expose PII or sensitive data to anyone with access to admin audit logs, and allowed injection of arbitrary attacker-controlled data into audit records. The patch replaces this with a typed SsfEvent.createAdminDetails() hook that only whitelists specific safe fields (credential_type, change_type, status, reason, etc.), ensuring free-form/PII fields never reach the audit log. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/406 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/406 Tue, 11 Aug 2026 11:55:40 GMT The Calendar view endpoint computes planned runs for cron-based timetables by iterating croniter until the year boundary with no upper bound, unlike the generic timetable path which caps at MAX_PLANNED_RUNS. Any authenticated user with Dag read access can create/view a Dag with a high-frequency cron schedule (e.g., a seconds-resolution cron) and trigger minutes of CPU consumption per request just by opening the Calendar tab, allowing them to pin/exhaust an API server worker with minimal effort. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/404 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/404 Tue, 11 Aug 2026 07:33:23 GMT When creating a new user via the admin REST API, group memberships specified in the UserRepresentation were assigned without checking whether the admin had 'manage-membership' permission on the target groups. This allowed an admin with only user-creation privileges (but not group membership management) to add newly created users to arbitrary groups, including groups with elevated privileges, bypassing fine-grained admin permission (FGAP) checks. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/405 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/405 Tue, 11 Aug 2026 07:33:44 GMT Before the patch, a client could supply a claim_token with claims using the reserved 'kc.' prefix (e.g., kc.client.id, kc.realm.name, kc.time.date_time), which would override or spoof server-controlled evaluation context attributes used by authorization policies. Additionally, when both a UMA permission ticket and a claim_token contained claims with the same key, the claim_token value silently overrode the ticket value, allowing a requesting party to override claims that a resource server intentionally set when creating the permission ticket, potentially bypassing intended policy restrictions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/402 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/402 Mon, 10 Aug 2026 18:09:35 GMT The searchLDAPByAttributes method used the LDAP_ENTRY_DN attribute value provided as a search parameter directly as the search base DN without validating that it lies within the configured usersDn subtree. This allowed an attacker (e.g. via the Admin REST API searchByAttributes endpoint) to query arbitrary LDAP entries outside the configured user search base, potentially exposing service accounts or other directory objects not meant to be treated as Keycloak users. The patch validates that the provided DN is a descendant of the configured usersDn before using it as the search base, returning an empty stream otherwise. high confirmed CVE-2026-16071 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/403 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/403 Mon, 10 Aug 2026 18:09:53 GMT The ServerSideDiff API decided whether to mask Secret data based on the caller-supplied liveResources\[i\].Kind/Group metadata rather than the actual kind of the target/live manifest being diffed. An attacker with get access to an Application could submit a liveResources entry with a spoofed non-Secret Kind (e.g., ConfigMap) paired with a real Secret target manifest at the same index, causing the server to skip masking and return the Secret's plaintext data (e.g., passwords, tokens) in the diff response. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/401 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/401 Mon, 10 Aug 2026 16:29:05 GMT PathMatcher.matches() performed direct string comparisons against the raw target URI without normalizing matrix parameters, double slashes, dot segments, percent-encoding, or trailing slashes. An attacker could mutate a protected path (e.g. /api/admin) using techniques like matrix params, encoded characters, or path traversal so that it no longer exactly matched the restricted resource pattern but still routed to the same backend resource on the server, causing the request to instead match a permissive catch-all policy (e.g. /*) and bypass intended authorization/deny policies. high confirmed CVE-2026-15573 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/397 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/397 Mon, 10 Aug 2026 12:05:41 GMT The SCIM user schema mapping used `Attributes.nameSet()` to enumerate all user profile attributes for reads and filtering, rather than `getReadable()`, which respects per-attribute view permissions configured in the user profile. This allowed admin-only attributes (e.g., attributes restricted to admin role via UPAttributePermissions) to be exposed and searchable through the SCIM API by users who should not have view access, bypassing the user-profile permission model. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/398 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/398 Mon, 10 Aug 2026 12:05:58 GMT The IdentityBrokerService failed to enforce the linkOnly restriction on the IdP-initiated SSO path, allowing an identity provider configured to only be used for account linking (not standalone login) to still authenticate users directly via SAML IdP-initiated SSO. This bypasses an administrator-configured security restriction meant to prevent an IdP from being used as a primary authentication mechanism, potentially allowing unauthorized login through a broker that was explicitly restricted to link-only usage. high confirmed CVE-2026-16442 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/399 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/399 Mon, 10 Aug 2026 12:06:46 GMT The SearchQueryUtils.getFields() method accessed chars\[i+1\] without checking bounds when encountering a backslash escape character, causing an ArrayIndexOutOfBoundsException if the backslash was the last character in the query. Since this method parses user-supplied search query strings (e.g., admin console user search), a malformed query with a trailing backslash could trigger an unhandled exception, potentially causing a 500 error or disrupting request processing. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/395 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/395 Mon, 10 Aug 2026 10:06:33 GMT The Matrix plugin's 'permissions' action (used for verification-management operations like verification-bootstrap, which can reset cross-signing keys and set recovery keys) was gated only by an 'encryption' and 'verification' config flag, without checking whether the sender was actually the bot owner. Any Matrix user able to send messages/commands to the bot could invoke sensitive verification actions such as forcing a cross-signing reset or listing verification state, potentially compromising encryption trust or account security. The patch adds an explicit senderIsOwner check both when advertising the action in tool discovery and when dispatching it, throwing a ToolAuthorizationError for non-owners. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/392 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/392 Mon, 10 Aug 2026 05:51:53 GMT The memory-host SDK maintained its own stale SECRET_PATTERNS table for redacting sensitive data in error messages, which lacked coverage for payment card numbers, CVV codes, and other payment credentials that the canonical redactor (src/logging/redact.ts) covers. Additionally, ACP's error redaction depended on module load order via a fragile injection hook, and when operator-configured redactPatterns were non-empty they fully replaced (rather than extended) built-in provider-token patterns, causing default secret patterns to go unredacted. This meant sensitive data such as credit card numbers or provider tokens could leak unredacted into error logs/output at these security boundaries. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/393 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/393 Mon, 10 Aug 2026 05:52:35 GMT The MS Teams group message admission logic only fell back to the allowlist re-check when the sender access denial reason was exactly 'group_policy_not_allowlisted'. If the sender access group was missing or referenced an unsupported/unrecognized group type (e.g., a Discord-typed access group), the denial reason code would differ, causing the code to skip the deny path entirely and treat the message as admitted, allowing unauthorized senders' messages to be processed and persisted. The fix makes any '!senderAccess.allowed' result authoritative, ensuring fail-closed behavior regardless of the specific reason code. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/391 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/391 Sun, 09 Aug 2026 17:01:50 GMT The chat display projection only sanitized audio blocks with `entry.source.type === 'base64'` and string `source.data`, failing to strip top-level `data` fields, non-string `source.data`, or filesystem/local path references (e.g. `file://`, `~/`, `C:\\`, UNC paths) embedded in audio block fields like `path`, `file`, `url`, `openUrl`. Authenticated WebSocket and HTTP/SSE history clients could therefore retrieve raw audio bytes or host-local filesystem paths that were persisted in transcript blocks, leaking sensitive local file locations or raw audio payloads that should have been redacted at the shared history boundary. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/390 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/390 Sat, 08 Aug 2026 23:42:00 GMT The debug proxy capture cloned every response body and read it with no bound on inter-chunk wait time. A malicious or stalled remote server could send response headers plus a single chunk and then go silent indefinitely, leaving the clone() tee branch open forever; since a tee branch only settles when both branches cancel or reach EOF, this caused the caller's own cancellation and the subsequent transport release to hang, tying up connection/transport resources. The patch bounds the read with an idle timeout, cancelling the stalled branch and recording the exchange as 'stalled' metadata instead of blocking indefinitely. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/389 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/389 Sat, 08 Aug 2026 19:59:08 GMT normalizeActRequest recursively processed nested 'batch' actions without any depth limit, allowing a specially crafted POST /act request body (up to the 1MB limit) with tens of thousands of nested batch wrappers to cause unbounded recursion and crash the process with a RangeError (stack overflow) before validation checks could run. The patch introduces a depth parameter bound by ACT_MAX_BATCH_DEPTH, rejecting deeply nested payloads early with a clear error instead of overflowing the call stack. medium confirmed CVE-2026-66418 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/388 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/388 Sat, 08 Aug 2026 19:40:48 GMT The decodeMatrixEnvAccountToken function used Number.isFinite to validate hex-decoded code points before passing them to String.fromCodePoint, but Number.isFinite does not bound values to the valid Unicode range (0x0-0x10FFFF). A crafted environment variable name with a hex escape exceeding 0x10FFFF causes String.fromCodePoint to throw an uncaught RangeError, crashing listMatrixEnvAccountIds and preventing discovery of all Matrix accounts during startup/doctor checks. The patch adds an explicit upper-bound check (codePoint > 0x10ffff) to reject such tokens gracefully. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/387 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/387 Sat, 08 Aug 2026 04:44:06 GMT The voice-call provider clients (Twilio/Telnyx/Plivo) built error messages by directly embedding the raw provider HTTP error response body, which can echo back credential-bearing request details such as the Authorization header value, API keys, or account tokens. These unredacted error messages were thrown and could propagate into application logs or user-facing diagnostics, exposing secrets to anyone with access to logs or error output. The patch adds `redactSensitiveText` to strip credential-like content from the error snippet before it is used in thrown errors. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/386 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/386 Fri, 07 Aug 2026 15:32:10 GMT The Dynamic Client Registration update endpoint allowed a client authenticated only with a Registration Access Token (RAT) - a token scoped to managing that single client's own registration - to change the client's protocol field (e.g., from openid-connect to saml). This let an attacker in possession of an OIDC client's RAT silently convert it into a SAML client, bypassing protocol-specific validations and policies enforced on client type, effectively an unintended privilege/scope escalation. The patch adds a check that rejects any update request containing a different protocol value when the caller authenticated via RAT. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/385 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/385 Fri, 07 Aug 2026 13:33:49 GMT The ProtocolMappersClientRegistrationPolicy only validated new protocol mappers against the allowed provider list, but for existing mappers (identified by ID) it skipped the type check entirely, only comparing configuration. This allowed a client (via Dynamic Client Registration, DCR) to swap an existing allowed mapper's type to a disallowed/dangerous mapper type (e.g., a hardcoded role mapper) while keeping the same mapper ID, bypassing the client registration policy restrictions and potentially escalating privileges via hardcoded roles or claims. high confirmed CVE-2026-15572 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/384 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/384 Fri, 07 Aug 2026 12:06:22 GMT The AccountIssuedVerifiableCredentialResource#delete endpoint deleted issued verifiable credentials by ID using a global lookup (session.users().removeIssuedVerifiableCredential(credentialId)) without verifying that the credential belonged to the authenticated user. Any authenticated user with the manage-account or manage-verifiable-credentials role could delete another user's issued verifiable credential simply by supplying that credential's ID, since the credential ID was not scoped to the requesting user. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/382 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/382 Fri, 07 Aug 2026 11:28:24 GMT The sub-agent hard-deny list (blocking tools like sessions_send, message, conversations_*, gateway) could be overridden by configuring those tool names in an operator's allow/alsoAllow config, allowing a sub-agent session to regain direct message-sending and session-control capabilities that are supposed to be permanently restricted to enforce the announce-chain communication contract. Additionally, the message tool was only disabled at spawn time for hidden launches, so resumed or dashboard-visible sub-agent sessions could rebuild their tool set without that restriction and message users directly, bypassing the intended isolation boundary. high confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/383 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/383 Fri, 07 Aug 2026 11:28:40 GMT Gateway connection URLs can embed basic-auth credentials or token/API-key query parameters. Before this patch, several diagnostic surfaces (`openclaw status`, `status --all` text/JSON, and `logs` CLI error output) printed the raw connection URL verbatim, including embedded secrets, and probe failure text/thrown errors could also echo credential-bearing URLs. This exposes live credentials to terminal output, log files, or bug reports pasted by operators. medium confirmed CVE-2026-66418 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/380 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/380 Fri, 07 Aug 2026 00:31:25 GMT The Google Chat API client read error response bodies from remote/proxy servers and included the raw text verbatim in surfaced error messages without redaction. If a malicious or misconfigured upstream/proxy server reflected the request's Authorization header (bearer token) back in the error response body, that token would be exposed in error messages returned to users, logs, or downstream consumers. The fix applies forced redaction (redactToolPayloadText) to the error response text before it is used in any error message. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/381 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/381 Fri, 07 Aug 2026 00:33:37 GMT The dashboard snapshot apiserver resolved snapshots by a global key without verifying that the snapshot belonged to the caller's organization/namespace. An authenticated user with snapshot delete permission in their own org could supply another org's public snapshot key to the `deletekey` subresource or `DELETE` endpoint, allowing them to read the secret deleteKey or delete a snapshot belonging to a different organization without proper authorization. Patch landed 24 days 22 hours 16 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/379 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/379 Thu, 06 Aug 2026 15:36:22 GMT The Micrometer user event metrics listener created a distinct time-series counter for each unique combination of tags, including the 'error' tag (and clientId tag) which is derived from user-controllable input such as arbitrary exception messages or client IDs. An attacker could trigger many different error messages or use many distinct client IDs to generate an unbounded number of unique metric tag values, leading to unbounded memory growth in the metrics registry and potential OOM in Keycloak or downstream observability systems. The patch mitigates this by generifying error codes (e.g., using Errors.GENERIC/INVALID_SCOPE/CLIENT_NOT_FOUND instead of raw exception messages) and adding a MeterFilter that caps the number of distinct tag values (default 10000) for the error and clientId tags, denying new tag values once the limit is reached. medium confirmed CVE-2026-16100 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/376 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/376 Thu, 06 Aug 2026 09:48:15 GMT The plugin-node capability authorizer only checked whether a capability token existed and was unexpired, without checking if the owning client had already been invalidated (e.g., removed by an operator). This allowed a removed node's already-issued capability URL to continue authorizing Canvas HTTP requests during the window between invalidation and full connection teardown, since the invalidated client remained in the clients set and its capability entry was still matched. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/377 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/377 Thu, 06 Aug 2026 09:49:00 GMT Feishu's message-action contract did not declare its native camel-case/snake-case chat identifier fields (chatId, chat_id, channel_id) as delivery targets for the edit, pin, and unpin actions. Because the shared cross-context policy engine only inspects declared delivery-target aliases, operators using these native Feishu fields could bypass the configured 'disable within-provider cross-context messaging' restriction and perform message mutations against a chat/conversation different from the current context. medium confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/378 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/378 Thu, 06 Aug 2026 09:49:39 GMT When using Django admin's 'save as new' functionality, inline formsets for related models where the user lacks add permission (but has view permission) could be rendered as editable/populated forms upon a validation error re-render, because the total/initial form counts were not cleared before instantiating the formset. This allowed a user without add permission on the inline model to potentially submit and persist changes to inline objects that they should only be able to view, effectively bypassing the permission check enforced elsewhere in the admin. medium confirmed CVE-2026-15920 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/374 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/374 Thu, 06 Aug 2026 04:27:38 GMT When a proxy or upstream server reflected the Discord bot's Authorization header value back in an error response (either HTML/text or JSON body), the raw bot token would be included unredacted in the error message surfaced to users/logs. This could expose the bot credential to anyone who could view logs, error output, or troubleshooting UI. The patch adds redaction of the token via redactToolPayloadText before formatting the final error text and before summarizing HTML bodies. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/373 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/373 Wed, 05 Aug 2026 21:38:57 GMT The evaluation runner copied the Git remote URL verbatim into LangSmith run tags without stripping embedded credentials (userinfo) from HTTPS or SSH-style URLs. If a developer's local git remote contained an access token or password (e.g., `https://user:token@github.com/...`), that secret would be persisted and exposed in run metadata/tags, which may be visible to other users or logged systems. The patch adds sanitization that strips userinfo while preserving host/path identity, and fails closed (omitting the tag) for ambiguous or malformed URLs. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/372 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/372 Wed, 05 Aug 2026 11:45:49 GMT The ShortURL API authorizer allowed any authenticated user (including org role None) to update or patch the status subresource of any short URL object, regardless of ownership. This let non-privileged users, or even users with the lowest permission level, tamper with the status (e.g., lastSeenAt) field of short URLs belonging to other users/organizations, which the fix now restricts to admin-only access. Patch landed 14 days 7 hours 7 minutes before CVE-2026-17183 was published. medium confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/371 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/371 Wed, 05 Aug 2026 09:52:39 GMT The DisplayName field, which is user/token controlled (e.g., from token display names or OIDC/JWT claims), was passed unsanitized into database username templates used to generate credentials, allowing SQL metacharacters or malicious payloads to be injected into generated usernames sent to the database. The patch adds sanitizeDisplayName to strip all characters except alphanumerics, hyphens, and underscores before using DisplayName in the credential generation request, and adds a warning for username_template usage without truncation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/369 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/369 Wed, 05 Aug 2026 04:28:35 GMT The stdout data handler for MCP stdio child processes called ReadBuffer.append synchronously without a try/catch. When a server (or attacker-influenced tool-result payload) produces a stdout frame exceeding the 10MiB ReadBuffer cap, append() throws synchronously inside the event callback, resulting in an unhandled exception that crashes the entire host process and terminates all concurrent sessions. The patch wraps the append/processReadBuffer calls in a try/catch that routes errors to onerror and gracefully closes the transport instead of crashing. high confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/370 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/370 Wed, 05 Aug 2026 04:33:16 GMT The BaseSerialization.deserialize method used import_string() on an attacker-controlled class name embedded in serialized DAG blobs (AIRFLOW_EXC_SER/BASE_EXC_SER nodes) to reconstruct exception objects. Because import_string will import arbitrary modules and access arbitrary attributes by dotted name, a crafted serialized DAG could cause the deserializer to import and execute code from any importable module (including modules with import-time side effects, or builtins like eval/os.system), leading to code execution or unintended behavior when a malicious/tampered serialized DAG is loaded. The patch restricts resolution to already-loaded classes validated as AirflowException subclasses or a fixed builtin allow-list, preventing import of attacker-named modules/classes. Patch landed 7 days 16 hours 6 minutes before CVE-2026-58076 was published. high confirmed CVE-2026-58076 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/368 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/368 Tue, 04 Aug 2026 20:05:44 GMT The previous authorizer for the ShortURL Kubernetes API allowed any authenticated user, regardless of org role, to perform any operation including list, watch, delete, deletecollection, and update on any short URL resource. This means a low-privileged user (e.g., org role None or Viewer) could list all short URLs in the org (exposing internal paths/links created by other users) or delete/modify short URLs belonging to other users, since there was no ownership or role check. Patch landed 27 days 2 hours before CVE-2026-19197 was published. medium confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/367 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/367 Tue, 04 Aug 2026 18:04:29 GMT When performing a server-side diff on a Kubernetes Secret, the kubectl.kubernetes.io/last-applied-configuration annotation on the predicted-live (target) resource was not masked, even though the corresponding annotation on the live resource was hidden. Since this annotation can contain the full JSON representation of the applied Secret (including plaintext data values), it could leak secret contents in the diff output (e.g., displayed in Argo CD UI/CLI diffs or logs) even though HideSecretData was meant to redact secret values symmetrically. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/360 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/360 Tue, 04 Aug 2026 15:06:14 GMT Shared group and channel chat sessions automatically loaded the workspace-root MEMORY.md file into the bootstrap context, exposing private long-term memory/context intended only for the main private session to all participants in a shared group or channel. Additionally, hooks could re-add or relabel the MEMORY.md file after initial filtering, bypassing session-type-based restrictions on private memory exposure. The patch enforces filtering of private memory files based on an authoritative chatType, re-applies the filter after hook mutations, and tracks file source identity to prevent relabeling/aliasing bypasses. high confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/362 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/362 Tue, 04 Aug 2026 15:08:18 GMT The PatchRequest.setSchemas() method did not handle a null value for the 'schemas' field, allowing an unauthenticated or authenticated attacker to send a SCIM PATCH request with "schemas": null to trigger a NullPointerException on the server, resulting in an unhandled 500 error instead of a proper validation error (400). This could be used for minor denial-of-service or availability disruption of the SCIM PATCH endpoint. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/361 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/361 Tue, 04 Aug 2026 15:07:45 GMT The DiscordRealtimeVoiceSession queued completed 'exact speech' messages without any bound on count or size while provider readiness, an active response, or playback prevented delivery. A stalled or misbehaving session could accumulate an unbounded backlog of speech text in memory, leading to unbounded memory growth and eventual resource exhaustion, and could later flush a large stale backlog. The patch introduces a fixed budget (32 messages / 32 KiB) and terminates the session on overflow, clearing state to prevent unbounded growth. medium confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/359 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/359 Tue, 04 Aug 2026 14:14:14 GMT Configuration options registered as sensitive (like database connection strings with passwords) were only masked when queried under their base section name. Team-scoped overrides stored in `\[<team>=<section>\]` config sections or `AIRFLOW__<TEAM>___<SECTION>__<KEY>` environment variables bypassed the sensitivity check entirely, exposing secrets like database credentials in clear text via the config API and `as_dict()` output. Patch landed 8 days 5 hours 11 minutes before CVE-2026-65017 was published. medium confirmed CVE-2026-65017 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/366 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/366 Tue, 04 Aug 2026 16:01:44 GMT GeoDjango spatial lookups optimistically parsed lookup values as GDALRaster before falling back to GEOSGeometry parsing. Because GDALRaster's constructor could interact with GDAL virtual filesystem drivers regardless of the write=False flag, a malicious string or dict passed into a spatial lookup (e.g., via the Django admin's changelist filtering, which allows staff users to submit arbitrary lookups) could cause the server to write files to disk or issue network requests to attacker-controlled URLs. The patch blocks strings and dicts from being treated as raster input in lookup contexts unless explicitly wrapped in GDALRaster, closing the SSRF/file-write vector while preserving normal model field assignment behavior. Patch landed 6 hours 41 minutes before CVE-2026-15307 was published. high confirmed CVE-2026-15307 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/365 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/365 Tue, 04 Aug 2026 16:01:13 GMT The check_for_language() function used an lru_cache with maxsize=1000, but did not limit the length of the lang_code strings used as cache keys. An attacker could submit many distinct, very long language codes (e.g., via the set_language() view's POST data), causing up to 1000 large strings to be retained in memory as cache keys, consuming excessive process memory. The patch adds a length check (max 500 characters) before the cached lookup, so long codes are rejected without being cached. Patch landed 6 hours 41 minutes before CVE-2026-15337 was published. low confirmed CVE-2026-15337 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/364 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/364 Tue, 04 Aug 2026 16:01:02 GMT Before this patch, GEOSGeometry parsing (from WKT or WKB) had no limit on the depth or number of nested GEOMETRYCOLLECTION elements. Because GEOS parses these recursively, a maliciously crafted input with deeply nested geometry collections could exhaust the stack or memory and trigger a fatal error/crash in GEOS, effectively causing a denial of service in any application that accepts user-supplied geometry data (e.g., via GeometryField model/form fields). The patch introduces a `max_geom_collections` parameter, forwarded through GEOSGeometry, model fields, and form fields, to cap the depth (for WKT) or total count (for WKB) of nested collections before they reach the GEOS library. Patch landed 6 hours 41 minutes before CVE-2026-15830 was published. high confirmed CVE-2026-15830 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/363 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/363 Tue, 04 Aug 2026 16:00:47 GMT The Django admin's display_for_field() rendered URLField values as clickable <a href> links without validating the URL scheme. A stored value using a dangerous scheme like javascript: or data: would be rendered as a clickable link, and clicking it would execute arbitrary script in the authenticated admin session (staff user context). Patch landed 6 hours 41 minutes before CVE-2026-15920 was published. medium confirmed CVE-2026-15920 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/357 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/357 Sun, 26 Jul 2026 02:36:23 GMT The Session object held only a weak reference (BaseObjectWeakPtr) to its parent DatabaseSync. If the JavaScript DatabaseSync object was garbage collected (and its underlying sqlite3 database closed/freed) while a Session created from it was still alive, subsequent operations on the session (e.g., changeset()) would dereference the freed database pointer, causing a use-after-free and crash (SIGSEGV). The fix changes the reference to a strong BaseObjectPtr so the database is kept alive as long as the session exists. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/356 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/356 Sat, 25 Jul 2026 14:52:10 GMT StringBytes::StorageSize contained a CHECK that fatally aborted the process when a hex-encoded string of odd length was written via Writev (e.g. an HTTP request body written before it is corked/flushed). This allowed a remote or local attacker who can influence data written as 'hex' encoding through a batched write path to crash the Node.js process, resulting in a denial of service. The patch removes the CHECK and uses integer division, consistent with the non-crashing single-write path. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/355 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/355 Sat, 25 Jul 2026 06:45:13 GMT When a client disconnects mid-response, the vendored compression middleware's zlib stream was never released because its cleanup only ran inside its own res.end() wrapper, which never executes on abrupt disconnects. Each aborted compressed response permanently pinned ~256 KiB of native zlib memory that survives garbage collection, allowing an attacker (or even normal bot/CDN traffic) to repeatedly open and abort requests, causing unbounded RSS growth until the server is OOM-killed. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/354 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/354 Fri, 24 Jul 2026 22:19:57 GMT The Graphite datasource read upstream /render responses and inbound resource-call request bodies fully into memory via io.ReadAll without any size limit. A malicious or compromised Graphite backend could return an extremely large (or decompression-bomb) response, or an authenticated user could send an oversized request body to a resource endpoint, forcing Grafana to allocate unbounded memory and crash the process (OOM). The patch adds configurable byte caps enforced via io.LimitReader and http.MaxBytesReader, rejecting oversized bodies with clear errors/HTTP 413. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/353 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/353 Fri, 24 Jul 2026 16:51:44 GMT The ngx_select_module.c code only validated cycle->connection_n against FD_SETSIZE at config-init time, but did not verify the actual file descriptor value returned by the OS before calling FD_SET() in ngx_select_add_event(). Since local file descriptors (e.g., for open files, not just connections) are not counted in cycle->connection_n, the OS can assign a fd >= FD_SETSIZE, causing FD_SET() to write beyond the bounds of the fixed-size fd_set bitmask, corrupting adjacent memory and potentially crashing or exploiting the worker process. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/352 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/352 Fri, 24 Jul 2026 15:43:40 GMT The zero-copy path in $r->print() referenced the internal string buffer of a Perl scalar (SV) directly into nginx's output chain without copying it, but only incremented the SV's reference count rather than protecting its buffer. If the Perl script mutates the scalar after calling $r->print() (e.g., appends to it or grows it), Perl may reallocate or overwrite the underlying buffer in place, while nginx's ngx_http_write_filter() may still have the original buffer queued for output. This can result in corrupted responses or, worse, sending stale/freed memory contents to the client, potentially leaking other memory contents. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/351 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/351 Fri, 24 Jul 2026 10:30:19 GMT Before this patch, the notification-history app installer did not wire in an AccessClient or enable RBAC filtering, so notification history queries were not restricted to folders the requesting user is authorized to read via `alert.rules:read`. This allowed any authenticated user (in a multi-tenant deployment) to query and view notification history for alert rules/folders belonging to other tenants or users without the required permissions, leaking potentially sensitive alerting/notification data across tenant boundaries. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/350 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/350 Thu, 23 Jul 2026 15:12:33 GMT DatabaseSync::Exec() and ApplyChangeset() held only a raw DatabaseSync* pointer while invoking sqlite3_exec()/sqlite3changeset_apply(), which can call back into JavaScript (user-defined functions, conflict/filter handlers). If the JS callback drops the last reference to the DatabaseSync JS object, V8's GC (which does not see the raw C++ pointer) can collect it, and subsequent use of the now-freed db pointer inside the SQLite C API leads to a use-after-free that can corrupt memory or be leveraged for further exploitation. The patch adds a BaseObjectPtr<DatabaseSync> guard to keep a strong reference alive for the duration of the call. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/349 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/349 Thu, 23 Jul 2026 13:30:02 GMT inspectdb generates a Python models.py file by writing raw table names and exception messages directly into comment lines without escaping. If a table name or an introspection error message contains newline characters, the unescaped output breaks out of the '#' comment prefix and injects arbitrary attacker-controlled lines into the generated source file, which is later imported/executed as Python code. Patch landed 12 days 5 hours 36 minutes before CVE-2026-15307 was published. medium confirmed CVE-2026-15307 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/348 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/348 Thu, 23 Jul 2026 12:13:09 GMT The localRepository's Create, Update, Write, Delete, and Move functions joined user-controlled paths (e.g. derived from folder/dashboard titles during export) directly with the repository root using safepath.Join without verifying the result stayed within the root directory. An attacker-controlled title containing traversal sequences like '../../../etc' could cause file writes, deletes, or moves outside the intended repository folder on the local filesystem. Patch landed 32 days 3 hours 32 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/347 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/347 Wed, 22 Jul 2026 21:06:16 GMT When force-deleting a folder via kubernetesFolderCascadeDelete, the cascade delete operation ran under a service identity that bypasses per-resource permission checks. A user who only had folders:delete permission (but not alert.rules:delete or folders:write on contained resources) could trigger deletion of alert rules and library elements within the folder subtree that they had no rights to access or modify, since only the top-level folder delete permission was checked before the entire cascade ran with elevated service-identity privileges. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/344 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/344 Tue, 21 Jul 2026 17:08:04 GMT The action ID validation logic for MPA (non-JS) form submissions iterated over all form data keys and, for any key starting with $ACTION_REF_, performed expensive decoding/validation work with no limit on the number of such keys. An attacker could submit a form with an enormous number of $ACTION_REF_ fields to force the server to perform excessive processing per request, exhausting CPU/memory and causing a denial of service. The patch caps processing to at most 2 $ACTION_REF_ fields (the expected maximum for legitimate forms) and short-circuits validation once that limit is exceeded. Patch landed 1 day 6 hours 12 minutes before CVE-2026-64641 was published. medium confirmed CVE-2026-64641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/345 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/345 Tue, 21 Jul 2026 17:08:17 GMT In the Edge runtime, Server Actions did not enforce the `serverActions.bodySizeLimit` configuration when reading request bodies (both multipart and non-multipart). The `// TODO: add body limit` comment confirms the limit check was never implemented for Edge, allowing attackers to send arbitrarily large request bodies to Server Actions running on Edge runtime, potentially exhausting memory/CPU resources despite the developer having configured a body size limit. Patch landed 1 day 6 hours 15 minutes before CVE-2026-64646 was published. medium confirmed CVE-2026-64646 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/346 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/346 Tue, 21 Jul 2026 17:10:02 GMT The previous detectContentType() implementation scanned the entire uploaded/upstream image buffer (including running a full sharp metadata parse and regex-based SVG detection over the whole buffer) to determine the image format, which allowed an attacker to submit a large or crafted file (e.g. large whitespace-padded pseudo-SVG or crafted image data) that would block the Node.js event loop for a long time during synchronous/CPU-heavy processing. This could be used to cause a denial of service against the image optimization endpoint. The patch limits the SVG detection to a bounded scan, removes the fallback to full sharp metadata parsing on the whole buffer, and only inspects the first 1024 bytes via the lightweight detector, greatly reducing worst-case CPU/blocking time. Patch landed 1 day 6 hours 15 minutes before CVE-2026-64644 was published. medium confirmed CVE-2026-64644 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/342 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/342 Tue, 21 Jul 2026 16:00:28 GMT Private key material (RSA d/p/q/dp/dq/qi, EC private scalar, DH private key) exported from OpenSSL 3 providers into BIGNUM copies was freed with BN_free instead of BN_clear_free, leaving the raw private key bytes in freed heap memory instead of being zeroed out. Similarly, OSSL_PARAM builder copies and the plaintext DER intermediate buffer used during encrypted PEM export were freed without cleansing, allowing sensitive key material to persist in process memory after use. This can enable extraction of private keys via memory disclosure vulnerabilities (heap dumps, core dumps, cold-boot attacks, or other memory-reading bugs). medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/343 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/343 Tue, 21 Jul 2026 16:00:48 GMT When exporting an RSA private key to JWK format, the code failed to check whether optional private parameters (d, p, q, dp, dq, qi) were successfully retrieved before passing them to the BIGNUM-to-JWK encoder. If an RSA key object has incomplete private parameters (e.g., loaded from a malformed or partial key), the null BIGNUM pointers were passed directly to SetEncodedValue, causing a crash (null pointer dereference) instead of a graceful error. The patch adds explicit null checks and throws a proper crypto operation error when required private key components are missing. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/341 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/341 Tue, 21 Jul 2026 13:53:53 GMT In the RBAC authz Check/BatchCheck flow, requests with an empty resource name but a specified parent folder were incorrectly answered by a capabilities-style early return that allows access if the user holds the action on ANY scope, ignoring the folder entirely. This let a user with permission on an unrelated folder (or resource instance) be granted access to folder-scoped queries such as 'can I list/set-permissions within folder X', effectively bypassing folder-based access restrictions. Patch landed 29 days 5 hours 3 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/340 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/340 Mon, 20 Jul 2026 20:01:07 GMT The fixup_dir function in mod_dir.c called strcmp on r->content_type without checking for NULL, causing a segfault when a request is not mapped to any content type (e.g., no matching handler or type). An attacker or specific server configuration causing requests to reach this code path with a NULL content_type could crash the worker process, resulting in denial of service. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/339 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/339 Mon, 20 Jul 2026 16:03:30 GMT When the LimitEmailToOrgMembers setting is enabled, Grafana restricts email notification integrations to only send to addresses belonging to organization members, preventing data exfiltration of alert data to arbitrary external emails. The email validator only checked V1 email integration configs and silently skipped V0 (Mimir) email integrations, allowing a user able to configure contact points to bypass the org-membership restriction entirely by using the V0mimir1 email integration type with arbitrary 'to' addresses. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/338 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/338 Mon, 20 Jul 2026 10:43:24 GMT The v2 PROXY protocol parser accessed src_addr/dst_addr/ports fields in the TCPv4/TCPv6 union without validating that the header's declared address length (hdr->v2.len) was large enough to actually contain those fields. A malicious or malformed proxy sender could send a v2 header with fam=0x11 or 0x21 but a len field smaller than sizeof(ip4)/sizeof(ip6), causing the code to read beyond the actual received data (into uninitialized or adjacent stack/heap memory) when extracting the address and port values. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/337 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/337 Mon, 20 Jul 2026 06:29:55 GMT The FFI implementation read the `signature.arguments`/`signature.return` values twice: once in native code to configure the actual native call interface (CIF), and again in JavaScript to build the argument-marshaling wrapper. Because `signature` could be a Proxy or an object with getters, a malicious signature object could return a large argument list (e.g., 8 arguments) to the native code establishing the CIF, then return a smaller list (e.g., 1 argument) to the JavaScript wrapper, causing the wrapper to pass fewer arguments than the native function actually expects, resulting in the native call reading uninitialized/stack memory for the unsupplied arguments. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/336 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/336 Fri, 17 Jul 2026 22:13:43 GMT In ngx_http_image_filter_module.c, ctx->length was set to the allocation size (image_filter_buffer) rather than the actual number of bytes received from the upstream when Content-Length was absent. If the upstream connection was truncated before filling the buffer, the image size parser and image decoders (ngx_http_image_size(), ngx_http_image_source()) would read/parse past the valid received data into uninitialized heap memory, potentially leaking memory contents or causing crashes when processing the resulting 'image' data (e.g., via JSON size output or generated thumbnail). medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/335 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/335 Fri, 17 Jul 2026 12:49:11 GMT In node's HTTP/2 implementation, nghttp2_session_mem_recv() could trigger callbacks (e.g., on receiving RST_STREAM or via JS callbacks during data delivery) that synchronously destroy an Http2Stream or invoke SendPendingData()/nghttp2_session_mem_send(), freeing nghttp2 internal stream state that is still being used by the in-progress mem_recv() call. This allows a remote peer to send crafted HTTP/2 frames (e.g., interleaved RST_STREAM and DATA frames) that cause the session to close/free stream memory mid-parse, leading to heap-use-after-free that can crash the process or potentially be leveraged for further exploitation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/332 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/332 Fri, 17 Jul 2026 12:21:39 GMT In mod_ldap's cache handling, the code released the LDAP cache lock after fetching a 'curl' (URL cache node) pointer and then re-acquired the lock later to access curl's sub-caches (compare_cache, dn_compare_cache). Between the unlock and re-lock, another worker thread/process could evict or free that URL node from the cache, leaving 'curl' as a dangling pointer that is subsequently dereferenced, causing memory corruption or a crash. The fix holds the lock continuously across the fetch-and-use sequence and re-fetches the URL node under the lock before write-back operations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/333 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/333 Fri, 17 Jul 2026 12:21:55 GMT Before the patch, mod_cern_meta.c merged every header line found in a .meta file directly into the outgoing response headers without restriction. Because HTTP framing-related headers (Transfer-Encoding, Content-Length, Connection, Trailer, Upgrade, Keep-Alive, TE) were not filtered, an attacker who could influence the content of a .meta file (e.g. via file upload, misconfiguration, or shared hosting) could set arbitrary or conflicting framing headers, enabling HTTP response splitting or request smuggling against clients or intermediary proxies. The fix explicitly rejects these framing headers and returns a 500 error if they are present in a .meta file. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/334 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/334 Fri, 17 Jul 2026 12:22:25 GMT When mod_remoteip processes a PROXY protocol v2 header with the LOCAL command, it returned without setting conn_conf->client_addr and client_ip, leaving them NULL. Later code that assumes these fields are populated (mirroring the v1 UNKNOWN path which was already fixed) would then dereference the NULL pointer, crashing the worker process. This is remotely triggerable by any client permitted to send a PROXY protocol header with the LOCAL command to a server with RemoteIPProxyProtocol enabled. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/331 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/331 Thu, 16 Jul 2026 19:49:02 GMT When xmlCreatePushParserCtxt() fails to allocate a parser context (e.g., under memory pressure), ngx_http_xslt_add_chunk() returns NGX_ERROR without setting ctx->ctxt, but the caller ngx_http_xslt_body_filter() still dereferences ctx->ctxt->myDoc on the error path, causing a NULL pointer dereference and worker process crash. The patch adds a check for ctx->ctxt == NULL before dereferencing it, avoiding the crash and gracefully sending the response. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/330 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/330 Wed, 15 Jul 2026 16:03:30 GMT The nginx script engine (used for rewrite, map, set directives and complex value evaluation) computed the required buffer length in a first pass and then wrote data in a second pass without re-checking bounds. When variables with side effects (e.g., regex captures modifying other variables) or non-cacheable/volatile variables were evaluated, the length computed in the length-pass could become smaller than the actual data written in the copy-pass, causing a heap buffer overflow. This is exploitable via crafted configurations combining map/set with capturing regexes and volatile variables, which can be triggered by attacker-controlled request data (URI, headers) matched against the regex. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/329 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/329 Wed, 15 Jul 2026 16:02:42 GMT The nginx script engine predicted a maximum length for computed variables/rewrite results (based on regex capture group max sizes) but the actual output could be shorter, especially with variable-length regex captures. The code returned the full predicted-length buffer without truncating to actual written length, leaking uninitialized (garbage) heap memory bytes to clients in HTTP responses via variables set by 'set', 'return', or map directives using regex captures. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/328 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/328 Wed, 15 Jul 2026 16:02:23 GMT When ngx_http_regex_exec() reallocates r->captures because the previous buffer was too small or marked for reallocation, it failed to reset r->ncaptures to 0 when the regex subsequently did not match. This left r->ncaptures referencing stale capture indices from a prior (larger) match, so later code reading $1, $2, etc. would read uninitialized or out-of-bounds memory from the newly allocated (and not fully populated) captures array, potentially leaking sensitive heap memory into response headers or bodies. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/327 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/327 Wed, 15 Jul 2026 16:02:04 GMT A subrequest that gets posted twice (once via ngx_http_subrequest() and again via ngx_http_postpone_filter() during unbuffered proxying with SSI includes) could be finalized twice, causing r->main->count to be decremented excessively. This reference-count corruption can lead to premature freeing of the request/pool while it is still referenced elsewhere, resulting in a use-after-free that could be leveraged for memory corruption or worker process crashes (DoS), and potentially further exploitation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/326 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/326 Wed, 15 Jul 2026 14:51:51 GMT Before the patch, nginx computed r->keepalive based on Connection header even for HTTP CONNECT requests, allowing the underlying connection to be treated as reusable for further HTTP request processing after a CONNECT tunnel was established. Since data sent by the client after the CONNECT blank line is meant to be tunneled (per RFC 2817), enabling keepalive could cause nginx to misinterpret tunneled bytes as pipelined HTTP requests, leading to request smuggling/desync between the client and backend. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/325 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/325 Wed, 15 Jul 2026 10:31:43 GMT The Perl module's sleep() and has_request_body() XS functions called SvRV() on the handler argument without checking whether it was actually a reference to a code value (SVt_PVCV). If a script passed a non-reference (e.g., a plain string) as the handler, SvRV() would dereference invalid memory, causing a segmentation fault and crashing the worker process. This is exploitable by any nginx configuration or perl script that accepts external input as the handler argument, leading to a denial of service. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/324 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/324 Wed, 15 Jul 2026 10:31:32 GMT The nginx perl module relied on SvREADONLY() to decide whether to zero-copy a Perl SV's buffer directly into an nginx buffer or ngx_str_t without incrementing its reference count. When the SV came from a short-lived context (e.g. within an eval block), Perl could free or reuse the underlying string memory after the eval scope ended but before nginx finished using the buffer, resulting in a heap use-after-free when the freed memory is later read (e.g. during response output or in the sleep/has_request_body deferred handler paths). This is remotely triggerable by any config that embeds perl handlers using eval-created strings/subs. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/323 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/323 Wed, 15 Jul 2026 10:31:15 GMT The nginx Perl module allowed Perl scripts to retain and reuse stale request objects across requests, or to bless arbitrary Perl scalars into the 'nginx' package, causing ngx_http_perl_set_request to dereference freed or attacker-controlled memory as an ngx_http_perl_ctx_t pointer. This can lead to segmentation faults (DoS) or potentially memory corruption/RCE if the freed memory is reused with attacker-controlled content. The patch adds validation via a global active-context pointer, ensuring only the currently active request context can be used. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/322 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/322 Tue, 14 Jul 2026 16:41:51 GMT The v14→v16 dashboard schema migration's getPanelPosition function recursed unconditionally when a panel could not fit into the row's grid area. A legacy row panel with a span greater than 12 produces a panelWidth larger than the 24-column grid, meaning it can never satisfy the fit check, causing infinite recursion and a stack overflow that crashes the Grafana backend process. The patch restores a callOnce guard so the function wraps to the next row at most once before returning nil instead of recursing forever. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/321 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/321 Tue, 14 Jul 2026 13:08:19 GMT When parsing HTTP/2 (gRPC) and proxy-v2 response headers, the code computed ctx->name.len/ctx->value.len from the HPACK-encoded field length (including a x8/5 expansion for Huffman-coded data) and passed it directly to ngx_pnalloc without validating it against the configured upstream buffer_size. A malicious or compromised upstream server could send crafted HEADERS frames with very large field lengths, causing nginx to allocate large amounts of request-pool memory per header field and across many fields in a header block, leading to excessive memory consumption and potential denial of service. The patch adds explicit checks that reject name/value lengths exceeding upstream->conf->buffer_size before allocation, and maintains a decreasing header_limit counter across the whole header block to bound total memory used per HEADERS frame. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/319 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/319 Mon, 13 Jul 2026 18:10:27 GMT The XSLT filter module parsed backend XML responses with XML_PARSE_NOENT enabled but without XML_PARSE_NONET, allowing external general entities declared in the internal DTD subset (e.g. SYSTEM "http://...") to be resolved over the network during parsing. Since XML parsing happens synchronously in the nginx worker process, a malicious or compromised backend response could cause the worker to block for a long time fetching a remote/slow resource, resulting in a denial-of-service condition, or be used for SSRF-style network requests from the server. The fix adds XML_PARSE_NONET to the parser options, disabling network-based resolution of external entities. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/318 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/318 Mon, 13 Jul 2026 18:10:10 GMT The nginx XSLT filter module parsed untrusted upstream XML with XML_PARSE_NOENT | XML_PARSE_DTDLOAD without restricting external general entity resolution declared in the internal DTD subset. An attacker who can influence the XML response body could declare an entity with a SYSTEM identifier pointing to a local file or (on network-enabled libxml2 builds) a remote URL, causing the worker process to read arbitrary local files or make outbound network requests, potentially leading to information disclosure or SSRF, and even worker blocking via slow network fetches. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/314 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/314 Tue, 07 Jul 2026 14:17:18 GMT When a unidirectional QUIC stream is created without a registered 'onstream' handler, JavaScript synchronously destroys the stream object, but native code (DefaultApplication) continues to access the now-destroyed Stream object, causing a use-after-free crash. Additionally, Session::Impl destructor called endpoint->RemoveSession() before releasing arena slots, allowing the last reference to the Session to be dropped and then having session_->env() accessed afterward, also a use-after-free. Both are remotely triggerable by any QUIC peer opening a unidirectional stream when no onstream handler is registered. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/315 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/315 Tue, 07 Jul 2026 14:17:36 GMT DomainNameValidator's regex used `$` instead of `\\Z` as the end anchor, which in Python regex matches before a trailing newline. This allowed strings like 'example.com\\n' to pass validation as a valid domain name, potentially enabling HTTP header/CRLF injection if such validated values were later embedded into HTTP headers or other newline-sensitive contexts outside Django's form fields. Patch landed 12 hours 2 minutes before CVE-2026-53878 was published. low confirmed CVE-2026-53878 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/316 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/316 Tue, 07 Jul 2026 14:17:48 GMT When constructing a GDALRaster from a bytes object, the code used sys.getsizeof() to determine the buffer size, which includes CPython's PyBytesObject overhead (~32-49 bytes) rather than the actual data length. This caused GDAL to read past the end of the allocated buffer into adjacent heap memory when accessing the vsi_buffer property, potentially disclosing sensitive heap memory contents or causing a crash. Patch landed 12 hours 2 minutes before CVE-2026-53877 was published. low confirmed CVE-2026-53877 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/317 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/317 Tue, 07 Jul 2026 14:18:10 GMT UpdateCacheMiddleware only skipped caching Set-Cookie responses varying on Cookie when the incoming request had zero cookies, so a request carrying any unrelated cookie (e.g., a language preference) bypassed the protection. This allowed a response that issues a new session or CSRF cookie to be stored in Django's shared cache and served to other users, leaking session cookies via a shared cache hit. The patch removes the 'no cookies at all' condition, always skipping caching when a response sets a cookie and varies on Cookie. Patch landed 12 hours 2 minutes before CVE-2026-48588 was published. low confirmed CVE-2026-48588 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/313 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/313 Tue, 07 Jul 2026 02:58:53 GMT The QUIC session's `closed` promise was not marked as handled before being rejected on error close, unlike the `opened` promise. If an application does not synchronously attach a handler to `session.closed`, a remote peer can trigger an error close (e.g., via a QUIC error code on connection close), causing an unhandled promise rejection that crashes the Node.js process by default, since Node exits on unhandled rejections unless configured otherwise. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/312 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/312 Mon, 06 Jul 2026 16:05:55 GMT BrotliCompress/BrotliDecompress.flush(kind) forwarded any user-supplied value directly to the native brotli encoder/decoder without validating it was within the valid brotli operation range \[0,3\]. Passing an out-of-range value such as Z_FINISH (4) or Z_BLOCK causes the native layer to spin at 100% CPU indefinitely, allowing an attacker who controls the flush argument (e.g., in a server that exposes stream flushing based on user input) to cause a denial of service. The patch validates the kind against the brotli bound range and throws ERR_OUT_OF_RANGE for invalid values. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/311 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/311 Mon, 06 Jul 2026 14:46:28 GMT The inspector's ProtocolHandler::WriteRaw() dereferenced the tcp_ pointer without checking for null. When a remote debugger client disconnects, OnEof() resets tcp_ to nullptr, but queued write requests scheduled via uv_async callbacks or triggered during ParseWsFrames() processing could still invoke Write()/WriteRaw() afterward, causing a crash (EXCEPTION_ACCESS_VIOLATION) due to null pointer dereference. This is remotely triggerable by a debugger client that connects to the Node.js inspector port and disconnects at a specific time while messages are still queued or being processed, resulting in a denial-of-service crash of the Node.js process. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/309 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/309 Mon, 06 Jul 2026 13:45:29 GMT When AuthDigestNonceLifetime is 0 (one-time-nonce mode) and no shared-memory counter was available, mod_auth_digest fell back to using the constant value 42 as the nonce time component instead of an incrementing counter. This makes the one-time-nonce completely predictable and identical across requests, allowing an attacker to reuse or forge nonces and replay digest authentication challenges, defeating the anti-replay protection the one-time-nonce mechanism is meant to provide. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/308 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/308 Mon, 06 Jul 2026 13:43:48 GMT When decoding a QUIC long-header packet with an unsupported version, ngtcp2_pkt_decode_version_cid() returns raw, unclamped DCID/SCID length fields from the wire (up to 255 bytes) instead of enforcing NGTCP2_MAX_CIDLEN (20). Endpoint::Receive() constructed CID objects directly from these lengths in the NGTCP2_ERR_VERSION_NEGOTIATION branch before the existing length check (which only applied to the supported-version path), causing a write past the fixed 20-byte ngtcp2_cid buffer and triggering an assertion abort, crashing the process. A single unauthenticated UDP datagram sent to any QUIC endpoint before handshake completion could remotely crash the server. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/307 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/307 Sat, 04 Jul 2026 09:29:54 GMT The `EscapeShell` function in Node.js task runner incorrectly escaped single quotes in shell arguments on Unix systems by replacing `'` with `\\'`, which does not properly terminate and re-enter single-quoted strings in POSIX shells. This caused shell syntax errors and could allow arguments containing single quotes to break out of the intended quoting context, potentially enabling command injection when passing positional arguments with single quotes to `node --run`. The fix replaces the broken `\\'` approach with the correct `'"'"'` technique (end single-quote, literal single-quote via double-quotes, restart single-quote). high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/306 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/306 Fri, 03 Jul 2026 18:35:59 GMT When a `charset_map` directive was configured with `utf-8` in the first column (source charset), nginx would immediately segfault upon processing requests. The charset module was never designed to handle UTF-8 as the source charset in a charset_map, and accessing the tables in this configuration caused a null pointer dereference. The patch adds a configuration-time check that rejects this invalid configuration with an error, preventing the crash. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/304 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/304 Fri, 03 Jul 2026 10:12:17 GMT Before this patch, the RBAC allowlist for unified storage did not include 'serviceaccounts' under the 'iam.grafana.app' group. This meant that when listing/searching/reading service accounts, the authzLimitedClient would not apply RBAC filtering, potentially allowing users without proper permissions to enumerate or read service account resources. The fix adds 'serviceaccounts' to the allowlist so that RBAC checks are properly enforced during list/search operations. Patch landed 7 days 9 hours 18 minutes before CVE-2026-33382 was published. high confirmed CVE-2026-33382 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/302 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/302 Thu, 02 Jul 2026 17:03:11 GMT Fix a bug in `copyPermissionModelFlagsToEnv` where the substring check `env\[key\].indexOf('--permission') !== -1` falsely treats unrelated `NODE_OPTIONS` values like `--title=--permission` as if the child already has an explicit Permission Model policy. This prevents flag propagation, causing the child to run without `process.permission`. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/301 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/301 Thu, 02 Jul 2026 15:30:36 GMT The Node.js Permission Model's `permission.drop('addon')` function was ineffective because the DLOpen code path only checked the `allow_native_addons` option (set at startup) but never performed a runtime permission check. This meant a process that started with `--allow-addons` could call `process.permission.drop('addon')` to signal it no longer wanted addon loading, but could still successfully load native addons via `process.dlopen()`. The fix adds a `THROW_IF_INSUFFICIENT_PERMISSIONS` check in the `DLOpen` function so the permission model is enforced at runtime. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/300 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/300 Tue, 30 Jun 2026 20:15:47 GMT The GET /api/library-elements/name/:name endpoint was registered without any authentication or authorization middleware, allowing unauthenticated or unprivileged users to read library panel data by name. The patch adds the standard `authorize(ac.EvalPermission(ActionLibraryPanelsRead))` middleware to enforce the library.panels:read permission check before serving the response. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/299 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/299 Tue, 30 Jun 2026 10:35:59 GMT The MemoryProvider's recursive readdir implementation would follow symlinks to directories without tracking which directories were already being traversed. If a circular symlink was present (e.g., a directory containing a symlink pointing back to itself or to an ancestor), the recursive walk would loop indefinitely until the call stack was exhausted, causing a stack overflow and crashing the Node.js process. The fix introduces a SafeSet to track currently-active directory entries during traversal and skips re-entering any entry already on the active path. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/298 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/298 Wed, 24 Jun 2026 14:53:10 GMT The `_generate_cache_key` function in Django's cache framework concatenated HTTP header values without any delimiter when building the cache key hash. This allowed two requests with different header values to produce the same cache key if the values concatenated to the same string (e.g., headers 'EU' and '' vs '' and 'EU'). The patch fixes this by using netstring encoding (length-prefixed with trailing comma) for each header value, ensuring unique encodings for distinct value combinations. Patch landed 13 days 1 hour 32 minutes before CVE-2026-53878 was published. medium confirmed CVE-2026-53878 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/297 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/297 Wed, 24 Jun 2026 14:52:53 GMT The template fragment cache key generation used a simple `:` delimiter between vary-on arguments without encoding the length of each argument, allowing cache key collisions between different argument combinations. For example, vary_on=\['a:b','c'\] and vary_on=\['a','b:c'\] would produce the same MD5 hash, potentially causing one user's cached content to be served to another user with different cache parameters. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/296 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/296 Tue, 23 Jun 2026 19:32:48 GMT In Node.js `util.inspect()` with `colors: true`, the `markNodeModules` function entered an infinite loop when an error stack trace contained a `node_modules` path segment with no trailing path separator (e.g., `at /app/node_modules/foo.js:1:1`). `StringPrototypeIndexOf` returned `-1` for `moduleEnd`, which caused `searchFrom` to be set to `-1`, making the next `indexOf` restart from index 0, rematch the same segment, and grow `tempLine` unboundedly until the heap was exhausted. The fix clamps `moduleEnd` to `line.length` when no trailing separator is found, allowing the loop to terminate normally. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/295 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/295 Tue, 23 Jun 2026 18:55:31 GMT Before this patch, Node.js WebCrypto's EdDSA (Ed25519/Ed448) signature verification would return 'true' for signatures involving small-order public keys or small-order R components in the signature, even when the signature was mathematically trivial/invalid. This is a signature verification bypass: an attacker can use a small-order public key (e.g., a low-order point) along with a crafted signature to produce a valid verification result without knowing the private key, since multiplying a small-order point by any scalar yields a point in the small subgroup. The patch adds explicit rejection of small-order points in both the public key and the signature's R component during verification. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/294 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/294 Tue, 23 Jun 2026 17:23:19 GMT The Kubernetes-based GET /tags API endpoint in Grafana's annotation app returned all annotation tags to any authenticated user regardless of their permissions. Before the patch, the tags handler was initialized without an access client and performed no authorization checks, meaning any authenticated user (including those with org role = None and no permissions) could enumerate all annotation tags in an organization. The patch adds a call to `authorizeReadOrganizationAnnotations` that verifies the caller has `annotations:read` permission with organization scope before returning tag data. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/293 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/293 Tue, 23 Jun 2026 11:33:43 GMT The `onError` function in standalone.js used `node.innerHTML` to render error messages, directly interpolating the `message` property from error objects into an HTML string template. If an attacker could control the error `message` (e.g., through a malicious WebSocket server response or crafted network error), they could inject arbitrary HTML/JavaScript into the DevTools UI. The patch replaces `innerHTML` with `textContent` via DOM node construction, neutralizing HTML injection. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/292 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/292 Tue, 23 Jun 2026 10:26:45 GMT Before the patch, the `listPermission` function for mapper-miss resources (folder-scoped CRDs like `*.ext.grafana.app`) would hit the `scopeMap\["*"\]` early-return check before forking to the folder-authz model. This meant that if a user had a resource-type wildcard permission (e.g., `unregistered.grafana.app/widgets:get` with scope `*`), the LIST endpoint would return `All: true` (allowing all objects) without requiring any folder-level authorization. The fix forks to `listPermissionWithFolderAuthz` before the wildcard check, ensuring folder-scoped resources always require both a stack role AND folder-level permission. Patch landed 57 days 8 hours 48 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/291 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/291 Mon, 22 Jun 2026 17:47:25 GMT Before this patch, ProxyBeaconSecret was optional. Without it, any host that could reach the proxy's UDP beacon port could send an unauthenticated datagram announcing an arbitrary backend URL, causing the proxy to add that URL as a balancer member and route client traffic to an attacker-controlled server. Since UDP source addresses are trivially spoofable, there was no reliable way to restrict who could inject members. The patch makes ProxyBeaconSecret mandatory, causing startup to fail if it is omitted, eliminating the unauthenticated mode entirely. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/290 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/290 Sun, 21 Jun 2026 11:21:01 GMT When http.Agent with keepAlive is used, there is a window between a socket entering the freeSockets pool (with parser detached) and being reassigned to a new request. If a server sends an HTTP response during this window, the data sits in the TCP buffer and gets silently consumed as the response for the next request — poisoning the response queue. The fix installs a low-level read guard on the socket handle so unsolicited data destroys the socket. This commit is a follow-up that changes the guard from a public 'data' event listener (which caused false ERR_STREAM_PREMATURE_CLOSE in node-fetch@2) to an internal onread hook, but the underlying security fix (destroying sockets with unsolicited data) was already present. Patch landed 2 days 6 hours 32 minutes before CVE-2026-48931 was published. high confirmed CVE-2026-48931 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/289 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/289 Fri, 19 Jun 2026 17:01:48 GMT Django's UpdateCacheMiddleware failed to recognize qualified Cache-Control directives (e.g., `Cache-Control: private="Set-Cookie"`) as restrictions on caching. The code used exact token matching against the full directive string, so `private="Set-Cookie"` would not match the string `private`, causing the response to be stored in a shared cache even though it was marked private. The patch introduces a `split_directive_names()` helper that strips the qualified value portion before comparison. medium confirmed CVE-2026-35193 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/283 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/283 Thu, 18 Jun 2026 05:24:51 GMT Node.js DNS lookup and net.connect functions accepted hostnames containing embedded NUL bytes (\\u0000). Because C strings are NUL-terminated, the underlying C library (getaddrinfo/c-ares) would truncate the hostname at the first NUL byte, causing the actual DNS lookup to resolve a completely different hostname than what the JavaScript code specified. This could allow bypassing hostname validation or allowlist checks in application code. The patch adds a `validateStringWithoutNullBytes` validator that throws ERR_INVALID_ARG_VALUE when NUL bytes are present. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48930 was published. high confirmed CVE-2026-48930 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/281 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/281 Thu, 18 Jun 2026 05:24:17 GMT Before this patch, TLS session tickets/sessions stored by Node.js could be reused for connections to different hosts. An attacker who could influence the session cache (e.g., via a malicious or compromised server, or by controlling the session data) could cause a client to reuse a TLS session authenticated for host A when connecting to host B, bypassing certificate verification for the second connection. The patch binds session data to the server identity by wrapping sessions with a prefix that includes the servername, and validates the identity matches before reuse. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48934 was published. high confirmed CVE-2026-48934 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/280 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/280 Thu, 18 Jun 2026 05:23:55 GMT The `FileHandle.utimes()` method (which calls `futimes` internally) did not check whether the Node.js Permission Model was enabled before modifying file timestamps. This allowed an attacker to bypass write-access restrictions enforced by the Permission Model by obtaining a file descriptor through a read-only open and then calling `fh.utimes()` to modify timestamps on files that should be protected from writes. The patch adds an explicit check that throws `ERR_ACCESS_DENIED` when the Permission Model is active. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48935 was published. high confirmed CVE-2026-48935 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/279 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/279 Thu, 18 Jun 2026 05:23:39 GMT The Node.js Permission Model's Net scope could be bypassed via `uv_pipe_chmod` on Unix Domain Sockets. Before the patch, `PipeWrap::Fchmod` did not check the Net permission scope, allowing code running under `--permission --allow-net=...` restrictions to call `pipe.fchmod()` and change permissions on a UDS pipe even when net access was denied. The patch adds a `THROW_IF_INSUFFICIENT_PERMISSIONS` check for `kNet` before allowing the chmod operation. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48936 was published. medium confirmed CVE-2026-48936 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/278 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/278 Thu, 18 Jun 2026 05:23:22 GMT When http.Agent uses keepAlive sockets, there is a window between a socket returning to the freeSockets pool (with the HTTPParser detached) and being reused for the next request. During this window, a malicious or misbehaving server can send unsolicited HTTP response data that sits in the TCP buffer and gets consumed as the response for the next client request, effectively poisoning the response queue. The fix attaches a 'data' event guard listener and calls resume() on idle sockets so any unsolicited data immediately destroys the socket instead of being silently buffered. Patch landed 4 days 17 hours 1 minute before CVE-2026-48931 was published. high confirmed CVE-2026-48931 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/277 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/277 Thu, 18 Jun 2026 05:23:04 GMT Before the patch, the WebCrypto cipher paths in AES and ChaCha20-Poly1305 computed the output buffer length as `int buf_len = data_len + ctx.getBlockSize() + (encrypt ? tag_len : 0)` where `data_len` is a `size_t` and the result is stored in an `int`. When `data_len` is very large (e.g., close to or exceeding INT_MAX), this arithmetic overflows the signed int, leading to a negative or incorrect buffer length being allocated and passed to OpenSSL, causing potential heap buffer overflow or memory corruption. The patch adds a `TryGetIntCipherOutputLength` helper that checks if the sum would exceed INT_MAX before computing the output length. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48933 was published. high confirmed CVE-2026-48933 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/288 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/288 Thu, 18 Jun 2026 05:26:26 GMT Before the patch, the `ProxyConfig` class stored the full proxy URL including plaintext credentials (username and password) in `this.href`. When tunnel establishment failed (e.g., 407 Proxy Authentication Required), Node.js would include `this.href` in the error message, causing proxy credentials to appear in error output, logs, or stderr. The patch redacts credentials from the stored href by clearing username/password from the parsed URL before storing it. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48615 was published. medium confirmed CVE-2026-48615 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/287 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/287 Thu, 18 Jun 2026 05:26:10 GMT When Node.js is run with the --permission flag (Permission Model), `process.report.writeReport()` did not check whether the process had FileSystemWrite permission before writing files to disk. This allowed code running under a restricted permission context to bypass filesystem write restrictions by writing diagnostic reports to arbitrary locations. The patch adds an explicit permission check using `permission.has('fs.write', resource)` before allowing the write operation. Patch landed 14 hours 6 minutes before CVE-2026-48617 was published. high confirmed CVE-2026-48617 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/286 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/286 Thu, 18 Jun 2026 05:25:54 GMT Before the patch, Node.js's `checkServerIdentity` function did not normalize Unicode/IDN hostnames to their ASCII-compatible encoding (ACE/Punycode) before comparing against certificate Subject Alternative Names. An attacker could use a Unicode full-width or lookalike character (e.g., the ideographic full stop '。' U+3002) in a hostname that would visually appear similar to a legitimate domain, bypassing TLS server identity verification because the raw Unicode string wouldn't match the ASCII certificate SAN, but the connection might still be allowed in certain edge cases. The patch converts the hostname to ASCII via `domainToASCII` before performing identity checks. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48618 was published. high confirmed CVE-2026-48618 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/285 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/285 Thu, 18 Jun 2026 05:25:25 GMT A malicious HTTP/2 server could send an unbounded number of ORIGIN frames with unique origins, causing the client-side `originSet` (a Set) to grow without limit for the lifetime of the session. This results in unbounded memory consumption on the client, leading to a denial-of-service condition. The patch caps the originSet at 128 entries (configurable via `maxOriginSetSize`) and destroys the session with an error when the limit is exceeded. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48619 was published. high confirmed CVE-2026-48619 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/284 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/284 Thu, 18 Jun 2026 05:25:09 GMT The `addContext()` method in Node.js TLS server constructed a RegExp without the case-insensitive flag 'i', causing SNI hostname matching to be case-sensitive. Since RFC 6066 specifies DNS hostnames are case-insensitive, an attacker in an mTLS configuration could send an uppercase or mixed-case SNI hostname (e.g., 'A.EXAMPLE.COM' instead of 'a.example.com') to bypass the per-tenant TLS context and its associated client certificate requirements, falling back to the default context which may have no or weaker client authentication. The fix adds the 'i' flag to the RegExp so matching is case-insensitive. Patch landed 7 days 23 hours 2 minutes before CVE-2026-48928 was published. high confirmed CVE-2026-48928 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/273 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/273 Thu, 18 Jun 2026 01:21:47 GMT Before the patch, exceptions thrown by TLS event listeners (resumeSession, OCSPRequest, newSession) were not caught and would propagate as uncaught exceptions, potentially crashing the Node.js process. A remote attacker could trigger these code paths by sending specially crafted TLS handshake data, causing the server to crash due to an uncaught exception from a user-supplied callback. The patch wraps these event emissions in try-catch blocks and routes errors through proper TLS error handlers (tlsClientError or server error events) instead. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/272 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/272 Wed, 17 Jun 2026 16:03:34 GMT A non-RSC HTML request with the `Next-Router-Prefetch: 1` header set could cause the server to enter the partial prefetch tree path, produce a null active cache node, and suspend the HTML render indefinitely until a timeout occurred. This could be triggered by any external client sending crafted HTTP headers to a Next.js App Router application, effectively causing a denial of service by hanging render threads. The fix ensures prefetch routing headers are only respected when the request is also a valid RSC request. Patch landed 35 days 7 hours 18 minutes before CVE-2026-64641 was published. medium confirmed CVE-2026-64641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/271 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/271 Wed, 17 Jun 2026 16:02:41 GMT In nginx's HTTP/3 QPACK dynamic table implementation, the insert buffer was allocated using the current table capacity (`dt->capacity`) rather than the maximum table capacity (`h3scf->max_table_capacity`). Since the table capacity can be increased later via a Set Dynamic Table Capacity instruction, subsequent insertions into the dynamic table could write beyond the initially allocated buffer, leading to a heap buffer overflow. The fix allocates the buffer using the configured maximum table capacity upfront to prevent overflow. Patch landed 3 hours 55 minutes before CVE-2026-42530 was published. high confirmed CVE-2026-42530 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/270 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/270 Wed, 17 Jun 2026 16:02:24 GMT The insert buffer for HTTP/3 QPACK dynamic table was allocated from the encoder stream's memory pool (`c->pool`) rather than the parent connection's pool (`c->quic->parent->pool`). When the encoder stream was closed and a new encoder stream was opened, the old pool would be freed but `dt->insert_buffer` would still point into that freed memory, causing a use-after-free. An attacker can trigger this by closing and reopening the QUIC encoder stream while QPACK dynamic table insertions are in progress. Patch landed 3 hours 55 minutes before CVE-2026-42530 was published. critical confirmed CVE-2026-42530 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/269 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/269 Wed, 17 Jun 2026 16:02:08 GMT Before the patch, nginx HTTP/3 used `h3c->known_streams\[index\]` (a pointer that could be NULL after a stream closes) to check whether a standard unidirectional stream (control/encoder/decoder) had already been created. Because stream closure and new stream creation are asynchronous and can happen within the same event-loop iteration, a malicious client could close a control/encoder/decoder stream and immediately open a new one of the same type. The server would see `known_streams\[index\] == NULL` (set by the close handler) and allow the new stream, potentially reusing or corrupting shared parsing state such as the QPACK encoder insert buffer. The fix introduces a persistent `created_streams` bitmask that is never cleared, preventing any stream type from being registered a second time regardless of whether the previous instance was closed. Patch landed 3 hours 55 minutes before CVE-2026-42530 was published. high confirmed CVE-2026-42530 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/268 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/268 Wed, 17 Jun 2026 16:01:45 GMT Before this patch, nginx's HTTP/2 upstream modules (gRPC and proxy_v2) did not validate header field lengths before using them to calculate buffer sizes for HPACK encoding. An attacker could craft requests with extremely long header values (method, URI, host, or custom headers) exceeding NGX_HTTP_V2_MAX_FIELD, causing integer overflow in the `len` calculation (`1 + NGX_HTTP_V2_INT_OCTETS + very_large_value`) which would lead to under-allocation and subsequent heap buffer overflow when writing the encoded headers. The patch adds length checks that return NGX_ERROR before any buffer allocation occurs when headers exceed NGX_HTTP_V2_MAX_FIELD. Patch landed 3 hours 55 minutes before CVE-2026-42055 was published. critical confirmed CVE-2026-42055 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/267 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/267 Wed, 17 Jun 2026 16:01:23 GMT In nginx's charset filter module, the `recode_from_utf8()` function had a 1-byte out-of-bounds read when processing invalid UTF-8 sequences that were saved across buffer boundaries. The `ngx_utf8_decode()` function stops advancing the pointer on the first invalid byte, so when processing a partially-saved invalid UTF-8 sequence, the `saved` pointer could remain behind `ctx->saved\[ctx->saved_len\]`, causing a subsequent read of memory beyond the saved buffer. The fix ensures the pointer advances past the entire saved sequence in this case. Patch landed 3 hours 55 minutes before CVE-2026-48142 was published. medium confirmed CVE-2026-48142 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/265 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/265 Tue, 16 Jun 2026 23:27:58 GMT Before the patch, passing a 'Bcc' key in the `extra_headers` argument of `EmailMessage` would cause the BCC addresses to be serialized directly into the email message headers, making them visible to all recipients. The `from`, `to`, `cc`, and `reply-to` headers were explicitly excluded from being written via `extra_headers`, but `bcc` was not, allowing it to leak into the message. The patch raises a `ValueError` when `Bcc` is found in `extra_headers`, directing users to use the `bcc` argument instead. Patch landed 48 days 19 hours 35 minutes before CVE-2026-15307 was published. medium confirmed CVE-2026-15307 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/263 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/263 Tue, 16 Jun 2026 08:18:35 GMT The Loki data source plugin allowed path traversal attacks via the resource URL parameter. Before the patch, user-supplied URL segments were directly interpolated into the Loki API path without validation, allowing an attacker to use '../' sequences to escape the '/loki/api/v1/' prefix and access arbitrary backend endpoints. The fix adds URL parsing and path cleaning to reject any paths that don't remain within the '/loki/api/v1/' prefix. Patch landed 6 days 7 hours 36 minutes before CVE-2026-10601 was published. high confirmed CVE-2026-10601 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/262 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/262 Fri, 12 Jun 2026 21:50:44 GMT In Next.js edge runtime, the `setTimeout` and `setInterval` polyfills incorrectly used `globalThis` (the Node.js global object) instead of the sandboxed edge runtime context object when invoking callbacks via `.apply()`. This allowed malicious code running in the edge sandbox to access Node.js globals like `process.mainModule.require()` and escape the sandbox entirely, gaining access to the Node.js runtime including filesystem operations, arbitrary module loading, and other restricted APIs. Patch landed 40 days 1 hour 30 minutes before CVE-2026-64641 was published. critical confirmed CVE-2026-64641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/260 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/260 Thu, 11 Jun 2026 16:23:44 GMT In Rails applications using ActiveSupport::CurrentAttributes, declaring an attribute named `:attributes` causes the generated accessor to shadow the internal `attributes` writer that `reset` relies on. This means `reset` can no longer clear the per-request state stored in `@attributes`, causing sensitive data (user identity, account info, request context) to leak across requests. The patch replaces the hand-maintained denylist with a dynamically computed one that covers all internal methods. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/261 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/261 Thu, 11 Jun 2026 16:24:15 GMT Declaring an attribute named `:attributes` in a subclass of `ActiveSupport::CurrentAttributes` shadows the internal `attributes` reader/writer that `reset` relies on to clear per-request state. This causes `reset` to stop clearing the state, leaking values across requests — exactly the isolation `CurrentAttributes` is designed to guarantee. The patch computes the invalid attribute names dynamically from the class's own methods, preventing any attribute declaration that would shadow internal methods. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/257 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/257 Thu, 11 Jun 2026 11:58:47 GMT An off-by-one error in the socket path truncation logic in cgid_init() caused a one-byte buffer overflow when writing the null terminator. Before the patch, `tmp_sockname\[sizeof(server_addr->sun_path)\]` wrote a null byte one position past the end of the `sun_path` field in the `sockaddr_un` structure, corrupting adjacent memory. The patch corrects this to `tmp_sockname\[sizeof(server_addr->sun_path) - 1\]`, which properly null-terminates within bounds. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/258 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/258 Thu, 11 Jun 2026 11:59:03 GMT In mod_cgid.c, `temp_core` was allocated using `sizeof(core_module)` instead of `sizeof(core_request_config)`. Since `core_module` is a module descriptor struct (typically much smaller than `core_request_config`), this results in allocating too little memory for the `core_request_config` structure. Subsequent writes to fields of `temp_core` beyond the allocated size would corrupt adjacent heap memory, potentially leading to crashes or memory corruption exploitable for privilege escalation or code execution. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/259 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/259 Thu, 11 Jun 2026 11:59:24 GMT Before the patch, the `get_req` function in mod_cgid read environment variable lengths (`curlen`) from a Unix socket without validating the size before allocating and reading into a buffer. A malicious or compromised cgid daemon (or a process that hijacked the socket) could send an extremely large `curlen` value, causing `apr_pcalloc` to allocate a huge buffer or triggering integer issues, and then reading that many bytes from the socket into the allocated region. Additionally, `uri_len` and `args_len` had no upper bound checks, and `env_count` was signed allowing negative values to bypass the `env_count < 0` check in certain scenarios. The patch adds `ENV_COUNT_MAX` (256) bound on env_count, upper bounds on uri_len and args_len (APR_PATH_MAX), and per-variable length validation (`curlen > APR_PATH_MAX`) in the environment reading loop. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/256 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/256 Wed, 10 Jun 2026 20:15:15 GMT The nginx secure_link module used early-exit byte-by-byte MD5 hash comparison (ngx_memcmp and individual byte checks), which leaks timing information about how many bytes of the hash match. An attacker can exploit response time differences to incrementally determine the correct hash value byte-by-byte, eventually forging valid secure links without knowing the secret key. The patch replaces the comparison with a constant-time XOR accumulation that always examines all 16 bytes before returning a result. Patch landed 6 days 22 hours 25 minutes before CVE-2026-42530 was published. medium confirmed CVE-2026-42530 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/255 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/255 Wed, 10 Jun 2026 08:11:04 GMT When Zanzana resolved permissions and mapped them back to legacy RBAC format, the scope was derived from the action prefix rather than the resource type. For sub-resource actions like `folders.permissions:read`, this produced `folders.permissions:uid:<uid>` instead of `folders:uid:<uid>`. Since legacy RBAC's `canAdmin` check evaluates `EvalPermission(folders.permissions:read, folders:uid:<uid>)`, the scope never matched and a user with admin rights on a folder could not manage that folder's permissions even though they were authorized to do so. The fix scopes objects by the resource type Zanzana listed them under, ensuring correct permission matching. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/254 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/254 Tue, 09 Jun 2026 16:38:30 GMT When Django's `startproject` or `startapp` command downloads a template archive from a URL, the Content-Disposition header's filename was used directly with `os.path.join()` to construct a path within a temp directory. An attacker-controlled server could return a filename like `/nonexistent/../../etc/passwd` or an absolute path, causing the file to be written outside the intended temporary directory. The fix replaces `os.path.join()` with `safe_join()`, which raises `SuspiciousFileOperation` if the resulting path escapes the base directory. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/253 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/253 Tue, 09 Jun 2026 15:43:53 GMT The UpdateCacheMiddleware used a substring check (`directive in cache_control`) to detect Cache-Control directives like 'private', 'no-cache', 'no-store', and 'public'. This meant that an extension directive like 'myprivate' or 'nopublic' would be falsely matched, causing responses that should be cached to not be cached, or causing Authorization-based Vary headers to be incorrectly omitted. More critically, the inverse case for 'public' means that a response with a custom directive containing 'public' as a substring would skip the Authorization vary header, potentially serving a user-specific cached response to other users. The fix replaces substring matching with exact token matching using `split_header_value`. medium confirmed CVE-2026-35193 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/252 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/252 Mon, 08 Jun 2026 20:31:05 GMT Before the patch, the contact point settings redaction logic used case-sensitive key matching when identifying secret fields to redact. An attacker or user with write access could submit secret field keys with non-canonical casing (e.g., 'INTEGRATIONKEY' instead of 'integrationKey') to bypass redaction, causing the plaintext secret to be returned in API responses instead of being redacted. The patch makes the field extraction and redaction logic case-insensitive so secrets are properly identified and redacted regardless of key casing. Patch landed 76 days 19 hours 37 minutes before CVE-2026-17033 was published. medium confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/251 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/251 Mon, 08 Jun 2026 12:10:16 GMT Before this patch, when HTTP/2 header blocks were handed off to JavaScript (via HandleHeadersFrame), the memory they occupied was immediately decremented from the session's memory accounting (maxSessionMemory), even though the JS objects could still hold references to that header data for the lifetime of the stream. This meant an attacker could send many requests with large headers, and once the headers were dispatched to JS, that memory would no longer count against the session limit, allowing effectively unlimited memory consumption. The patch fixes this by retaining the header memory charge until the stream is removed from the session. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/249 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/249 Mon, 08 Jun 2026 10:30:08 GMT The LinkButton component in @grafana/ui rendered an <a> element with the href prop passed directly without sanitization. An attacker could inject a javascript: URL as the href value, which would execute arbitrary JavaScript when a user clicked the link. The patch extracts href from the spread props, sanitizes it via textUtil.sanitizeUrl (which neutralizes dangerous schemes like javascript:, data:, and vbscript: to about:blank), and places the sanitized value after {...otherProps} so it always wins. Patch landed 77 days 5 hours 41 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/244 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/244 Fri, 05 Jun 2026 10:45:24 GMT In .htaccess (per-directory) context, modules like mod_rewrite, mod_setenvif, and mod_proxy_fcgi allowed use of file-reading expression functions (file(), filesize(), filemod()) and file-test operators (-d, -e, -f, -s, -L, -h, -x) without restriction. An attacker who could place or modify an .htaccess file could use these functions to read arbitrary filesystem content (e.g., file('/etc/passwd')) or probe file existence/properties outside the web root. The patch centralizes the restriction by applying AP_EXPR_FLAG_RESTRICTED_FILE_FUNC in ap_expr_parse_cmd_mi() whenever the context is htaccess (cmd->pool == cmd->temp_pool), blocking these filesystem-exposing functions. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/245 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/245 Fri, 05 Jun 2026 10:45:42 GMT In `ap_regname`, the capture group index was read from the PCRE name table without bounds checking. A regex with a very large capture group number (up to 65535, as PCRE allows) would cause `apr_array_push` to be called in a tight loop up to 65535 times, allocating excessive memory. The patch adds a sanity check limiting capture group indices to 1024, returning -1 for unreasonably large values, and callers now propagate this as a configuration error. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/246 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/246 Fri, 05 Jun 2026 10:45:57 GMT Before this patch, the DAV filesystem repository handler (dav_fs_get_resource) had no check preventing WebDAV clients from directly accessing or manipulating the internal DAV state directory (DAV_FS_STATE_DIR, typically '.DAV'). This directory contains lock database files and other internal state. An attacker could use WebDAV methods (GET, PUT, DELETE, PROPFIND, etc.) to read, modify, or delete these internal state files, potentially corrupting the lock database, bypassing WebDAV locks, or leaking sensitive server-side state. The patch adds an explicit check that denies access when the requested path's filename or parent directory name matches DAV_FS_STATE_DIR. Patch landed 3 days 8 hours 22 minutes before CVE-2026-42535 was published. high confirmed CVE-2026-42535 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/247 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/247 Fri, 05 Jun 2026 10:46:28 GMT The code before the patch contained integer overflow vulnerabilities in bounds checking for line length validation in mod_substitute. When checking `vb.strlen + len + replen > cfg->max_line_length`, if the sum of these apr_size_t values overflowed, the comparison would yield a false result, allowing the write to proceed even when the combined length exceeded the max_line_length limit. The patch fixes this by restructuring the comparisons to avoid overflow: checking each addend individually against the remaining space. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/243 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/243 Fri, 05 Jun 2026 10:44:58 GMT Before the patch, `closeIdleConnections()` only considered connections with `last_message_start_ == 0` as idle, meaning connections that had been established but hadn't yet sent any data (pre-request phase) were not included. An attacker could establish many TCP connections without sending any HTTP data, keeping them open and preventing the server from closing them via `closeIdleConnections()`, leading to resource exhaustion. The patch adds a `received_data_` flag so connections that have not yet sent data are also treated as idle and properly closed. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/242 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/242 Thu, 04 Jun 2026 15:53:25 GMT The FTP proxy directory listing code used `ap_escape_uri()` for href attributes in generated HTML links. `ap_escape_uri()` does not escape HTML special characters like `<`, `>`, `"`, and `&`, so a malicious FTP server could return filenames containing HTML/JavaScript that would be injected unescaped into the href attribute of generated links. The fix replaces `ap_escape_uri()` with `ap_os_escape_path()` (for path encoding) wrapped in `ap_escape_html()` (for HTML entity encoding), properly neutralizing any HTML-special characters in filenames. Patch landed 4 days 2 hours 43 minutes before CVE-2026-29170 was published. medium confirmed CVE-2026-29170 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/241 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/241 Thu, 04 Jun 2026 08:32:46 GMT The ctauditscts script constructed a shell command string by interpolating unsanitized values (specifically tmp_leaf_pem\[1\] filename and timestamp_ms, and potentially log_url from the database) directly into a string passed to os.system(). An attacker who could control the temporary file path or log_url value (e.g., via a malicious log URL in the SQLite database containing shell metacharacters) could inject arbitrary shell commands. The fix replaces os.system() with subprocess.call() using a list of arguments, which bypasses the shell entirely and prevents command injection. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/239 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/239 Wed, 03 Jun 2026 17:53:22 GMT Django's signed cookie salt derivation historically used `cookie_name + salt` (concatenation), which is ambiguous: a cookie named 'a' with salt 'bc' produces the same salt string as a cookie named 'ab' with salt 'c'. This means a valid signed cookie for one (name, salt) pair could be submitted as a valid cookie for a different (name, salt) pair, allowing an attacker to reuse a legitimately obtained signed cookie value in an unintended context. The patch changes the default of SIGNED_COOKIE_LEGACY_SALT_FALLBACK from True to False, so Django now only accepts cookies signed with the unambiguous new salt derivation by default. medium confirmed CVE-2026-6873 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/238 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/238 Wed, 03 Jun 2026 14:31:00 GMT Django's get_signed_cookie derived its signing salt by concatenating the cookie name (key) and salt arguments using simple string concatenation: `key + salt`. This meant that distinct (name, salt) pairs that produce the same concatenated string (e.g., name='ab', salt='c' and name='a', salt='bc') would use the same signing namespace, allowing a signed cookie created for one context to be accepted in another. The patch fixes this by using an injective encoding that includes the salt length as a prefix, making it impossible for different (name, salt) pairs to collide. Patch landed 3 hours 53 minutes before CVE-2026-6873 was published. low confirmed CVE-2026-6873 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/237 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/237 Wed, 03 Jun 2026 14:30:40 GMT When using EMAIL_USE_TLS with fail_silently=True, a failed STARTTLS handshake would leave self.connection set to a partially-initialized SMTP connection that had not completed TLS negotiation. Subsequent email sends would reuse this unencrypted connection, transmitting emails (including credentials and content) in plaintext. The patch fixes this by only setting self.connection after all configuration steps (STARTTLS and login) succeed, using a temporary self._partial_connection during setup. Patch landed 3 hours 53 minutes before CVE-2026-7666 was published. low confirmed CVE-2026-7666 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/236 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/236 Wed, 03 Jun 2026 14:30:20 GMT Django's UpdateCacheMiddleware performed a case-sensitive check for Cache-Control directives like 'private', 'no-cache', and 'no-store'. If a response manually set 'Cache-Control: Private' (or any mixed/uppercase variant), the middleware would fail to recognize it and cache the response anyway, potentially storing and serving private user data to other users. The patch lowercases the Cache-Control header value before checking for these directives. Patch landed 3 hours 53 minutes before CVE-2026-8404 was published. low confirmed CVE-2026-8404 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/235 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/235 Wed, 03 Jun 2026 14:30:00 GMT Django's UpdateCacheMiddleware and cache_page decorator failed to add 'Authorization' to the Vary header when caching responses to authenticated requests. This meant that a response generated for an authenticated user (with a specific Authorization header) could be served from cache to unauthenticated users or users with different credentials, potentially leaking private/user-specific data. The patch adds 'Authorization' to the Vary header whenever the request contains an Authorization header and the response is not explicitly marked 'Cache-Control: public'. Patch landed 3 hours 53 minutes before CVE-2026-35193 was published. low confirmed CVE-2026-35193 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/234 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/234 Wed, 03 Jun 2026 14:29:44 GMT The `has_vary_header()` function in Django's cache utility failed to strip whitespace from individual Vary header values before comparison. This meant that a `Vary: *` header with surrounding whitespace (e.g., `Vary: * ` or `Vary: * `) would not be recognized as containing the wildcard, causing `UpdateCacheMiddleware` to cache responses that should never be cached (responses with `Vary: *` should not be cached as they vary on all request headers). This could lead to private/personalized data being stored in and served from the cache to unintended users. Patch landed 3 hours 53 minutes before CVE-2026-48587 was published. low confirmed CVE-2026-48587 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/232 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/232 Tue, 02 Jun 2026 20:16:11 GMT In the IAM K8s role API, a user holding `permissions:type:delegate` had their scope resolved to the wildcard `*` in the RBAC scope map. The `checkPermission` function short-circuited on wildcard presence, allowing a delegate holder to satisfy ANY scope check including `permissions:type:escalate`. This meant a user with only delegate permissions could perform escalate-level operations (granting elevated roles they shouldn't be able to grant). The fix adds `SkipWildcard: true` to the permissions resource mapping and retains the literal `permissions:type:*` scope alongside the resolved wildcard, so exact scope matching is required for permission type checks. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/229 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/229 Mon, 01 Jun 2026 19:06:36 GMT In Apache httpd's mod_include (Server Side Includes), when a conditional expression (<!--#if expr="..." -->) fails to parse or evaluate, the content inside the if/elif/else block was still being printed to the client despite the error. This meant that content intended to be conditionally hidden could be disclosed to clients who craft malformed SSI expressions. The patch fixes this by setting a new SSI_FLAG_COND_ERROR flag on parse failure and ensuring the printing flag is cleared, so the enclosed content is suppressed. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/226 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/226 Mon, 01 Jun 2026 09:03:32 GMT The HostAuthorization middleware in Rails failed to reject malformed Host headers containing extra port segments (e.g., `www.example.com:80:80`) when the allowed host was configured with an explicit port. Because `sanitize_string` always appended an optional `PORT_REGEX?` suffix, a host like `www.example.com:80` would generate a regex that also matched `www.example.com:80:80`. This allowed attackers to bypass the host allowlist with a malformed Host header, potentially reaching downstream code (such as redirect logic) that constructs URLs from the Host header, enabling open redirect or host header injection attacks. The patch fixes this by not appending an extra optional port segment when the configured host already contains a port. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/227 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/227 Mon, 01 Jun 2026 09:04:16 GMT The Action Cable PostgreSQL adapter used String#size (character count) instead of String#bytesize (byte count) to determine if a channel name needed hashing before being used as a PostgreSQL identifier. Since PostgreSQL limits identifiers to 63 bytes but the check used character count, multibyte channel names with ≤63 characters but >63 bytes were passed unhashed to PostgreSQL, which silently truncated them. This caused the adapter to subscribe under the full untruncated name but receive notifications under the truncated name, resulting in broadcast messages being misrouted to the wrong channel subscribers. An attacker could craft a channel name that truncates to match a victim's channel name, causing them to receive messages intended for another user. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/228 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/228 Mon, 01 Jun 2026 09:04:34 GMT The PostgreSQL Action Cable adapter used `String#size` (character count) instead of `String#bytesize` (byte count) to decide whether to hash a channel identifier. PostgreSQL silently truncates identifiers to 63 bytes, so a multibyte channel name with ≤63 characters but >63 bytes would be passed unhashed to PostgreSQL, which would truncate it. The adapter subscribes using the full unhashed name but receives notifications under the truncated name, causing broadcasts to the long channel to be delivered to whichever subscriber holds the 63-byte truncation of that name — enabling cross-stream message delivery to unintended subscribers. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/225 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/225 Sat, 30 May 2026 15:51:17 GMT When a Node.js Buffer is backed by a SharedArrayBuffer, another thread can modify the underlying memory between the validation step (validate_utf8) and the conversion step (convert_valid_utf8_to_utf16) in StringBytes::Encode. This TOCTOU race condition can cause undefined behavior, potential memory corruption, or incorrect string encoding. The patch copies SharedArrayBuffer-backed data before processing to prevent concurrent modification. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/224 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/224 Fri, 29 May 2026 18:03:27 GMT When a user configured a git repository with an `http://` URL and a personal access token (PAT), the token was transmitted in cleartext on every git operation because `git.NewRepository` adds basic auth unconditionally regardless of the URL scheme. The validators never rejected this combination, meaning tokens could be intercepted by network observers. The patch adds validation that rejects `http://` URLs when a token is configured (unless explicitly allowed via `allow_insecure` flag or development mode). medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/221 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/221 Fri, 29 May 2026 14:23:37 GMT The Alert Group edit route was registered with only read-level permissions (AlertingRuleRead/AlertingRuleExternalRead), meaning Viewer-role users could navigate directly to the edit URL and interact with the editable group form. While the backend correctly returned 403 on save attempts, the frontend exposed the full edit UI to unauthorized users. The patch changes the route guard to require AlertingRuleUpdate/AlertingRuleExternalWrite, aligning it with other edit routes. Patch landed 24 days 1 hour 10 minutes before CVE-2026-10601 was published. low confirmed CVE-2026-10601 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/222 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/222 Fri, 29 May 2026 14:24:07 GMT GitHub provisioning webhooks were authenticated by HMAC signature only, but the HMAC covers only the request body (not headers or timestamps). This means a captured (body, X-Hub-Signature-256) tuple could be replayed indefinitely until the webhook secret rotates, causing repeated re-enqueueing of sync jobs. The patch adds a TTL-bounded replay cache keyed on the validated signature, silently dropping previously-seen signed requests. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/220 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/220 Fri, 29 May 2026 10:46:54 GMT The `SnapshotPublicModeOrCreate` and `SnapshotPublicModeOrDelete` middleware functions called `ac.Middleware(ac2)(ac.EvalPermission(...))` which returned a new HTTP handler but never invoked it, effectively making the RBAC permission check dead code. Any authenticated user could create or delete snapshots regardless of whether they had the required permissions (`snapshots:create` or `snapshots:delete`). The patch fixes this by directly calling `ac2.Evaluate()` and properly enforcing the permission check. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/219 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/219 Thu, 28 May 2026 22:06:38 GMT The `GetDataSourcesByType` method in Grafana's datasource service returned all datasources of a given type without checking the caller's `datasources:read` permissions. An authenticated user with access to the API endpoint that internally calls `GetDataSourcesByType` (e.g., `ListConnections` with a plugin filter) could enumerate and read metadata for datasources they are not authorized to access. The patch adds per-datasource permission evaluation using the requester's access control scopes before returning results. Patch landed 24 days 20 hours 56 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/217 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/217 Thu, 28 May 2026 16:25:38 GMT Before the patch, the DELETE endpoint for short URLs in the Kubernetes storage backend deleted by UID alone without scoping to the caller's org ID. This meant a user in one organization could delete short URLs belonging to another organization by simply knowing or guessing the UID. The patch adds org_id scoping to the DELETE SQL query, ensuring users can only delete short URLs within their own organization. Patch landed 40 days 9 hours 17 minutes before CVE-2026-28378 was published. high confirmed CVE-2026-28378 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/218 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/218 Thu, 28 May 2026 16:26:00 GMT Before this patch, the `validateOnUpdate` function in the Grafana folder API did not perform any access escalation check when a folder was moved to a new parent. This allowed an authenticated user (e.g., an Editor in a target folder) to move a folder they had write access to into a destination folder where they had higher privileges than at the source, effectively gaining elevated permissions over the folder's contents transitively. The patch adds a `checkMoveAccess` call that uses a BatchCheck to compare the user's permission tier at the old parent vs. the new parent and blocks moves that would result in privilege escalation. Patch landed 88 days 34 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/213 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/213 Thu, 28 May 2026 11:01:37 GMT The `ref` query parameter in the `history` and `files` endpoints was forwarded directly to backends (including the GitHub REST API) without any validation. An attacker could supply a malicious `ref` value containing shell metacharacters, path traversal sequences, or other dangerous strings that would be passed as-is to api.github.com or local git operations. The patch adds validation at the connector layer, rejecting any `ref` that isn't a valid branch name or commit SHA before reaching any backend. Patch landed 88 days 5 hours 8 minutes before CVE-2026-17033 was published. medium confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/212 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/212 Thu, 28 May 2026 05:10:24 GMT The SQLite session extension had a bug where applying a malformed/corrupt UPDATE changeset that omits old values for primary-key columns would pass NULL to sessionBindValue(). Before the patch, the condition `p->abPK\[i\] || (bPatchset==0 && pOld)` would evaluate to true for primary-key columns regardless of whether pOld was NULL, causing NULL to be passed to sessionBindValue() which could crash the process. The fix adds a NULL check on pOld first: `pOld && (p->abPK\[i\] || bPatchset==0)`, ensuring NULL is never passed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/210 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/210 Thu, 28 May 2026 02:15:45 GMT The Mailgun ingress authentication could be bypassed by sending the `signature` parameter as an array instead of a string. When `signature` is an array, `ActiveSupport::SecurityUtils.secure_compare` raises an exception before returning 401 Unauthorized, causing the request to result in a 500 error rather than an authentication failure. This means an attacker could bypass authentication entirely by sending a malformed signature parameter. The fix adds a type check to ensure `signature` is a String before performing the comparison, returning 401 for non-string values. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/209 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/209 Wed, 27 May 2026 22:18:55 GMT In the ruler export endpoints, a user with folder read access (folders:read) but without rule-level access (alert.rules:read) could enumerate and read alert rules from folders they should be denied access to. In getRulesWithFolderFullPathInFolders, when explicit folderUIDs were provided, the old code only checked folder visibility but not rule-level authorization; it silently dropped inaccessible folders instead of denying — but the actual searchAuthorizedAlertRules call was passed the raw folderUIDs list rather than the filtered query.NamespaceUIDs. In getRuleGroupWithFolderFullPath, lacking rule access caused an ErrAlertRuleNotFound which mapped to 500 rather than 403, leaking information. The patch adds explicit AuthorizeAccessInFolder checks before rule retrieval. Patch landed 83 days 20 hours 51 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/208 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/208 Wed, 27 May 2026 21:33:11 GMT The `PatchLibraryElement` endpoint allowed any user with `library.panels:write` permission on a library element to move it to any folder, including folders they cannot write to or even see. The route-level guard only checked write permission on the element itself, not create permission on the destination folder. The patch adds an explicit `library.panels:create` evaluation on the destination folder UID before allowing the move. Patch landed 88 days 18 hours 37 minutes before CVE-2026-17033 was published. medium confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/207 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/207 Wed, 27 May 2026 19:15:15 GMT The `isPublicURL` function used naive string matching to determine if a URL is public, allowing an attacker to bypass webhook registration restrictions. Specifically, `strings.Contains(url, "localhost")` would return true for legitimate public hosts like `notlocalhost.grafana.com`, blocking valid webhooks, but more critically the incomplete RFC1918 check (only `172.16.` prefix, missing `172.17`-`172.31`) meant Grafana could be tricked into registering webhooks pointing to internal/private infrastructure in the 172.17-172.31 range, potentially enabling SSRF-like scenarios where external webhook providers attempt to call back to internal services. The patch replaces string matching with proper URL parsing and CIDR range checks. Patch landed 96 days 3 hours 8 minutes before CVE-2026-19197 was published. medium confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/205 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/205 Wed, 27 May 2026 18:16:05 GMT The webhook endpoint's `Authorize` method returns `DecisionAllow` unconditionally (to allow anonymous GitHub webhook delivery), and the endpoint previously accepted both GET and POST methods. This allowed unauthenticated callers to use the GET method to enumerate repository existence and webhook configuration state by observing different HTTP response codes (404 for non-existent repos, 400 for repos without webhooks, 401 for repos with webhooks when HMAC validation fails). The patch removes GET from `ConnectMethods()` so only POST is accepted. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/206 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/206 Wed, 27 May 2026 18:16:27 GMT Before the patch, when a user updated a repository's URL, the system would automatically copy the existing stored authentication token to the new repository configuration (via CopySecureValues) without requiring a new token. This allowed an attacker or unauthorized user to pivot a repository's URL to a different target while reusing a valid stored token, potentially using the Grafana instance's credentials to authenticate against an attacker-controlled or unintended repository. The patch adds a check that rejects update operations where the URL changes but no new token is provided. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/211 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/211 Thu, 28 May 2026 02:16:02 GMT Before the patch, the Mailgun ingress authentication code passed the `signature` parameter directly to `ActiveSupport::SecurityUtils.secure_compare` without validating it was a string. When an attacker sends `signature\[\]` as an array parameter (standard Rails array parameter syntax), `secure_compare` raises an exception rather than returning false, causing the authentication check to fail with an unhandled error (500) instead of returning 401 Unauthorized. While this doesn't directly bypass authentication, it disrupts the ingress and could be used to prevent legitimate email processing or probe the endpoint. The fix adds a `signature.is_a?(String)` check before calling `secure_compare`. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/204 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/204 Wed, 27 May 2026 13:32:37 GMT The provisioning files API only checked permissions on the resource's current database location when updating an existing resource, but never verified permissions on the destination folder when moving a resource to a different path. This allowed a user with write access to folder A to move any resource into folder B (which they have no access to) simply by writing the file to folder B's path via the provisioning files API. The patch adds a dual permission check: both the source (existing DB location) and destination folder must be authorized before a cross-folder move is permitted. Patch landed 89 days 2 hours 35 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/203 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/203 Wed, 27 May 2026 12:03:21 GMT Before the patch, the apistore client had a no-op optimization that skipped the update call to unified storage entirely when the request body bytes were identical to the existing resource. This meant that permission/RBAC checks were never performed for no-op updates, allowing users without write permissions to receive a 200 OK response when sending a PUT/PATCH with identical bytes. The patch moves the no-op check to the server side, where RBAC is enforced even when the bytes are unchanged. Patch landed 26 days 6 hours 40 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/202 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/202 Wed, 27 May 2026 10:47:26 GMT Before this patch, the `authzLimitedClient` allowlist did not include `iam.grafana.app/users`, meaning RBAC enforcement was not applied to user search queries in unified storage. A user with any access to the search endpoint could retrieve all users without having the appropriate scoped permissions, bypassing access control restrictions. The patch adds `iam.grafana.app/users` to the allowlist so that RBAC is enforced when filtering user search results. Patch landed 89 days 5 hours 26 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/201 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/201 Wed, 27 May 2026 10:46:58 GMT In HTTP/2, cookie headers are sent as separate HPACK header fields and merged by mod_http2 into a single Cookie header. Before this patch, when multiple cookie headers were received in an HTTP/2 request, only the first one counted against LimitRequestFields, while subsequent ones were silently merged without incrementing the field count. This allowed an attacker to bypass the LimitRequestFields directive (which protects against DoS via excessive headers) by sending many cookie headers in a single HTTP/2 request. The patch fixes this by setting *pwas_added = 1 for each merged cookie, ensuring each cookie counts against the limit. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/200 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/200 Wed, 27 May 2026 09:26:06 GMT The `Storage.prototype.length` getter in Node.js webstorage lacked a V8 Signature check, allowing it to be called with any `this` value. When called with an incompatible receiver (e.g., `Storage.prototype` itself or any non-Storage object), the C++ callback `StorageLengthGetter` would proceed to call `Storage::Length()` on an invalid/null SQLite handle, causing a segmentation fault and crashing the Node.js process. The fix adds a `v8::Signature` bound to the Storage constructor template so V8 rejects incompatible receivers with a TypeError before the C++ code runs. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/199 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/199 Wed, 27 May 2026 05:12:18 GMT The `FolderReadmePanel.tsx` component rendered markdown content using `dangerouslySetInnerHTML` after processing it through `rewriteRelativeMarkdownLinks()`, which performs DOM manipulation that can mutate sanitized HTML into executable content (mXSS). The patch adds a second `textUtil.sanitize()` (DOMPurify) call after the DOM round-trip to re-sanitize the HTML before injection. Additionally, server-sourced URLs in `PullRequestButtons.tsx`, `RepositoryActions.tsx`, `RepositoryOverview.tsx`, and `ResourceTreeView.tsx` were passed directly to `LinkButton`/`window.open` without sanitization, allowing `javascript:` protocol URLs from a malicious server response to execute arbitrary JavaScript. Patch landed 89 days 10 hours 59 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/197 Tue, 26 May 2026 16:04:33 GMT The Watch RPC in Grafana's Unified Storage compiled an ItemChecker for per-item authorization and applied it to streamed events, but the initial-events backfill path (when SendInitialEvents=true) emitted every item from the backend without consulting the checker. This allowed any user who could issue a Watch request with SendInitialEvents=true to receive all resources in the namespace, regardless of per-item folder-based authorization restrictions. The patch adds `if !checker(iter.Name(), iter.Folder()) { continue }` inside the ListIterator callback so backfill honors the same per-item authorization as the live event stream. Patch landed 45 days 3 hours 33 minutes before CVE-2026-33382 was published. high confirmed CVE-2026-33382 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/196 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/196 Tue, 26 May 2026 10:19:57 GMT Passing `-0` as the `keylen` argument to `crypto.pbkdf2()`, `crypto.pbkdf2Sync()`, `crypto.scrypt()`, or `crypto.scryptSync()` bypasses the `validateInt32` check (since `-0 < 0` is `false` in JavaScript) and reaches the native C++ binding. V8 boxes `-0` as a HeapNumber rather than a tagged SMI, causing the binding's `IsInt32()` assertion to fail and aborting the entire Node.js process with SIGABRT. This is reachable from any code that passes user-controlled or JSON-parsed values as `keylen`, making it a remotely-triggerable denial-of-service. The fix coerces `-0` to `+0` with `keylen += 0` after validation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/195 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/195 Tue, 26 May 2026 07:44:07 GMT In mod_http2's `c2_setup_io` function, beam bucket callbacks (referencing `c2` connection object) were registered before pipe creation. If pipe creation failed (e.g., due to file descriptor exhaustion), the callbacks remained registered with references to the `c2` object that would subsequently be freed/invalidated during cleanup. The fix moves callback registration to after successful pipe creation, ensuring callbacks are only set when the setup succeeds and are not left dangling on failure paths. Patch landed 13 days 10 hours 49 minutes before CVE-2026-48913 was published. high confirmed CVE-2026-48913 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/192 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/192 Mon, 25 May 2026 02:16:23 GMT Before this patch, the Node.js QUIC implementation did not call SSL_set1_host() to enable OpenSSL's hostname verification against the server certificate's SAN/CN fields. This meant that a QUIC client in 'strict' or 'auto' verifyPeer modes would accept any valid certificate (signed by a trusted CA) regardless of which hostname it was issued for, enabling man-in-the-middle attacks. The patch adds SSL_set1_host() calls via a new set_verify_hostname() method, ensuring the server's certificate actually matches the intended servername. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/194 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/194 Mon, 25 May 2026 02:17:33 GMT The default policy for QUIC preferred address handling was 'use' (or mapped to USE_PREFERRED), meaning clients would automatically migrate their connection to whatever IP address a server advertised as its preferred address. A malicious server could advertise a preferred address pointing to an attacker-controlled host, causing the client to redirect its QUIC connection traffic to that address — enabling data exfiltration that is indistinguishable from legitimate QUIC connection migration at the network level. The patch changes the default to 'ignore', so clients only migrate when explicitly configured to do so with preferredAddressPolicy: 'use'. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/189 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/189 Fri, 22 May 2026 15:17:35 GMT The `reason_phrase` setter in Django's `HttpResponseBase` class did not validate or sanitize control characters, allowing an attacker to inject arbitrary HTTP headers via carriage return (\\r) and newline (\\n) characters in the reason phrase. This is an HTTP Response Splitting vulnerability where a crafted reason phrase could inject additional headers or manipulate the HTTP response structure. The patch adds a regex check that raises `BadHeaderError` when control characters are detected in the reason phrase. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/190 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/190 Fri, 22 May 2026 15:18:09 GMT In nginx's rewrite module, when a rewrite replacement string had no variables but contained overlapping captures (e.g., ^/((.*))$ with $1$2), the buffer length calculation was incorrect. The old code calculated escape overhead for the entire URI rather than per-capture, and failed to account for overlapping captures properly, resulting in a heap buffer that was too small for the actual replacement string. This allowed a specially crafted URI to trigger a heap buffer overflow when nginx performed the rewrite. Patch landed 3 days 22 hours 35 minutes before CVE-2026-9256 was published. high confirmed CVE-2026-9256 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/184 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/184 Thu, 21 May 2026 21:46:42 GMT The patch fixes multiple use-after-free (UAF) vulnerabilities in Node.js's QUIC implementation. The most concrete UAF is in streams.cc: after EmitClose triggers a JavaScript callback via MakeCallback, JS re-entrancy could destroy the Session object, but the code would still call session->RemoveStream(id()) on the potentially-destroyed session (with a null impl_). Additionally, in bindingdata.cc, the uv_check_t handle was closed inline with uv_close() passing nullptr as the callback, meaning libuv could access the handle's memory after BindingData was destroyed during Environment cleanup. The patch introduces CheckWrap/CheckWrapHandle with proper deferred cleanup via uv_close callback. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/185 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/185 Thu, 21 May 2026 21:46:59 GMT A Use-After-Free vulnerability existed in the QUIC Session::OnTimeout() function. When SendPendingData's scope guard called UpdateTimer(), it could synchronously re-enter OnTimeout(), which could trigger FinishClose → EmitClose → Destroy → impl_.reset() → ~Impl → RemoveSession(), dropping the last BaseObjectPtr from the endpoint map and freeing the Session object. The outer OnTimeout/SendPendingData frames would then continue operating on the freed memory. The fix adds a strong reference (BaseObjectPtr) to keep the Session alive for the duration of the operation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/186 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/186 Thu, 21 May 2026 21:47:27 GMT Before the patch, the QUIC endpoint had no default limits on connections (maxConnectionsPerHost=0 and maxConnectionsTotal=0, meaning unlimited), and the handshake timeout defaulted to UINT64_MAX (effectively infinite). An attacker could initiate a large number of QUIC handshakes from many IP addresses or a single IP, consuming server resources (ngtcp2 connections, TLS state, JS objects) indefinitely without ever completing the handshake. The patch adds a default handshake timeout of 10 seconds and default connection limits of 100 per host and 10,000 total to bound resource exposure. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/187 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/187 Thu, 21 May 2026 21:47:45 GMT Before this patch, the QUIC endpoint had no rate limiting on version negotiation packets and immediate connection close packets sent to remote hosts. An attacker could spoof source IP addresses and send packets with unsupported QUIC versions or invalid tokens, causing the server to send large numbers of response packets to victim IPs (amplification attack) or exhaust server resources. The patch adds per-host rate limiting using the existing LRU tracking structure, capping both version negotiation and immediate close responses at 10 per tracked host. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/188 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/188 Thu, 21 May 2026 21:48:02 GMT Before the patch, if a QUIC session was closed during an early handshake failure (before the HTTP/3 application was fully started), the server would call `nghttp3_conn_submit_shutdown_notice` and `nghttp3_conn_shutdown` on an nghttp3 connection whose control streams were never bound. This caused an assertion failure inside nghttp3 (asserting `conn->tx.ctrl != NULL`), crashing the Node.js process. The fix adds a `started_` guard so these functions are only called after the H3 application has fully initialized its control streams. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/179 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/179 Thu, 21 May 2026 14:04:44 GMT The `execute_ar` and `run_explain` methods evaluated ActiveRecord expressions outside of a readonly connection context, allowing write operations to bypass the intended read-only restriction. An attacker with access to the `rails query` command could execute destructive AR expressions like `Post.delete_all` or `Post.first.update!(title: 'hacked')` that modify the database. The patch wraps the `eval` calls inside `with_readonly_connection {}` blocks so that any database writes attempted during expression evaluation are rejected. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/180 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/180 Thu, 21 May 2026 14:05:00 GMT The `execute_ar` and `run_explain` methods evaluated ActiveRecord expressions without wrapping them in a readonly connection context. This meant destructive ActiveRecord calls like `Post.delete_all`, `Post.first.update!(...)`, or `Post.destroy_all` could bypass the intended read-only protection and execute write operations against the database. The patch wraps the `eval` calls with `with_readonly_connection { ... }` to enforce the readonly constraint during expression evaluation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/178 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/178 Wed, 20 May 2026 12:19:15 GMT Before the patch, the Django admin change form allowed actions to be executed against arbitrary objects, not just the object being edited. An attacker could craft a POST request to a change form URL (for object A) but include the ACTION_CHECKBOX_NAME value of a different object (object B), causing the action to be executed on object B instead. This allowed privilege escalation or unauthorized modification/deletion of objects the user might not intend to affect. The fix adds a server-side check ensuring the checkbox value matches exactly the object being edited. Patch landed 76 days 6 hours 26 minutes before CVE-2026-15920 was published. high confirmed CVE-2026-15920 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/175 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/175 Wed, 20 May 2026 07:57:34 GMT Calling `to_i` on very long strings in Ruby can take an extremely long time due to the algorithmic complexity of bignum conversion, which can be exploited as a DoS vector. Before the patch, `ActiveModel::Type::Integer#cast_value` would call `to_i` on arbitrarily long strings without any length limit. The patch fixes this by truncating strings to `_limit * 4` bytes (e.g., 16 bytes for a 4-byte integer) before calling `to_i`. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/176 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/176 Wed, 20 May 2026 07:57:55 GMT Before this patch, ActiveModel::Type::Integer would call `to_i` on arbitrarily long strings without any length restriction. Ruby's `to_i` on a very large string (e.g., 5 MB of digits) performs significant computational work proportional to the string length, allowing an attacker to send a large integer string in any parameter that gets cast to an integer (e.g., an ID or age field) to cause severe CPU exhaustion and denial of service. The patch limits the input to `_limit * 4` bytes before calling `to_i`. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/167 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/167 Tue, 05 May 2026 15:57:18 GMT Django's UpdateCacheMiddleware erroneously cached responses where the Vary header contained an asterisk ('*'). Per RFC 7231, 'Vary: *' means the response is unique per request and must never be served from cache, as it may contain private/user-specific data. An attacker could potentially receive cached private data intended for another user if the server responded with Vary: * but Django still stored and served it from cache. Patch landed 5 hours 59 minutes before CVE-2026-6907 was published. low confirmed CVE-2026-6907 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/168 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/168 Tue, 05 May 2026 15:57:33 GMT When SESSION_SAVE_EVERY_REQUEST=True, Django's session middleware would set a session cookie on responses but failed to include 'Vary: Cookie' in the response headers when the session was not explicitly modified. This meant caching proxies could cache a response containing a Set-Cookie header with a specific session key, and serve that cached response (with that session cookie) to other users, allowing an attacker to steal or fixate another user's session. The patch ensures that whenever a session cookie is set in the response, the Vary: Cookie header is also added. Patch landed 5 hours 59 minutes before CVE-2026-35192 was published. low confirmed CVE-2026-35192 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/169 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/169 Tue, 05 May 2026 15:57:51 GMT In Django's ASGI deployments, the MemoryFileUploadHandler relied solely on the Content-Length header to determine whether a file upload should be stored in memory. Since ASGI doesn't guarantee that Content-Length accurately reflects the actual request body size (e.g., with chunked transfer encoding or a deliberately understated header), an attacker could send a multipart file upload with a small or missing Content-Length value but a very large body, bypassing FILE_UPLOAD_MAX_MEMORY_SIZE and forcing the server to load arbitrarily large files into memory. The patch fixes this by seeking to the end of the stream to measure the actual size when possible, falling back to Content-Length only for non-seekable streams. Patch landed 5 hours 59 minutes before CVE-2026-5766 was published. low confirmed CVE-2026-5766 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/165 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/165 Mon, 04 May 2026 16:51:22 GMT Before the patch, any user or service account could modify the `ownerReferences` field of a SecureValue during an update operation. This allowed unprivileged users to convert a shared secure value (with an owner reference linking it to a data source or other resource) into an inline one or vice versa, potentially bypassing access control policies that depend on owner references to determine secret scope and access. The patch restricts `ownerReferences` mutations to only `AccessPolicy` identity types, preserving the existing references for all other callers. Patch landed 9 days 5 hours 19 minutes before CVE-2026-33381 was published. medium confirmed CVE-2026-33381 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/163 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/163 Thu, 30 Apr 2026 16:59:40 GMT Before the patch, calling `pathToFileURL()` with a UNC path containing a malformed hostname (e.g., one with a space) would cause a Node.js process crash via a failed `CHECK()` assertion. The `CHECK(out->set_hostname(...))` call aborts the process when `set_hostname()` returns false for invalid hostnames. The fix replaces the hard crash with a proper `ERR_INVALID_URL` exception. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/159 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/159 Tue, 28 Apr 2026 18:25:57 GMT The original `handleRedirectTo` function in `app.ts` consumed a stored redirect URL from sessionStorage after login without checking whether the URL belonged to the same origin. An attacker could craft a login URL containing `?redirectTo=https://evil.com/phishing` to store a cross-origin URL, which would then be passed directly to `locationService.replace()` after the user logged in, redirecting them to an attacker-controlled site. The patch adds an origin check using `new URL()` to ensure only same-origin redirects are followed via frontend navigation. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/158 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/158 Tue, 28 Apr 2026 17:50:21 GMT Before the patch, when a POST request was submitted to the Django admin changelist view with list_editable fields, the formset used for saving data was constructed directly with `FormSet(request.POST, request.FILES, queryset=modified_objects)` rather than going through `_get_formset_with_permissions()`. This meant the per-object permission check that removes editable fields for unauthorized objects was bypassed during form submission. An authenticated admin user with restricted per-object change permissions could modify objects they were not permitted to edit by crafting a POST request to the changelist view. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/157 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/157 Tue, 28 Apr 2026 17:03:33 GMT Before the patch, `GetErrorSource()` in `node_errors.cc` could trigger a `CHECK_GE(end, start)` assertion failure (process crash) when V8 reported a negative or invalid `end` column for certain malformed JavaScript syntax (e.g., invalid `using` declarations). The patch removes the hard assertion and instead adds a guard so that the underflow arithmetic and out-of-bounds access are avoided, returning early if `end < script_start` or `end < 0`. This could be triggered by any user-supplied JavaScript evaluated by Node.js, causing a denial of service. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/151 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/151 Mon, 27 Apr 2026 12:59:49 GMT The code before the patch used non-constant-time comparison functions (apr_crypto_equals was already constant-time, but the local implementation in mod_session_crypto.c and the reliance on apr_crypto_equals without a guaranteed fallback) when comparing cryptographic digests in digest authentication and session crypto. A timing attack against the digest comparison in mod_auth_digest could allow an attacker to determine the correct digest byte-by-byte by measuring response times, potentially enabling authentication bypass. The patch replaces these comparisons with guaranteed constant-time functions. Patch landed 7 days 2 hours 36 minutes before CVE-2026-33006 was published. high confirmed CVE-2026-33006 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/148 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/148 Sun, 26 Apr 2026 16:43:28 GMT The validate_status_line function in Apache httpd failed to check for newline characters and control characters in the status line reason phrase (the text after the 3-digit status code). An attacker who could influence the status line (e.g., via a proxied backend response or certain CGI/module interactions) could inject CRLF sequences to inject arbitrary HTTP response headers or split the response. The patch adds a call to ap_scan_http_field_content to reject any status line containing invalid characters. Patch landed 7 days 23 hours before CVE-2026-33523 was published. medium confirmed CVE-2026-33523 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/150 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/150 Sun, 26 Apr 2026 16:43:55 GMT The code before the patch used strcmp() to compare digest authentication hashes, which is vulnerable to timing attacks. An attacker could measure response times to infer the correct digest value byte-by-byte. The patch replaces strcmp() with apr_crypto_equals(), which performs a constant-time comparison that prevents timing oracle attacks on the authentication mechanism. Patch landed 7 days 23 hours 5 minutes before CVE-2026-33006 was published. high confirmed CVE-2026-33006 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/147 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/147 Sun, 26 Apr 2026 16:21:43 GMT When Apache HTTP Server processed ap_expr expressions in .htaccess files (htaccess context), it used the full unrestricted expression parser instead of the restricted one. This allowed users with .htaccess write access to use dangerous ap_expr functions (such as %{req:...}, %{env:...}, file system functions, or other privileged lookups) that are normally restricted to server configuration. The patch adds AP_EXPR_FLAG_RESTRICTED when parsing expressions in htaccess context across mod_rewrite, mod_setenvif, and mod_proxy_fcgi. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/143 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/143 Sun, 26 Apr 2026 16:00:02 GMT The `ajp_msg_check_header` function checked if the AJP message body length (`msglen`) exceeded `msg->max_size`, but the buffer also includes `AJP_HEADER_LEN` bytes for the header itself. Since `msglen` refers only to the body/payload length, the actual data written would be `msglen + AJP_HEADER_LEN` bytes, potentially overflowing the allocated buffer if `msglen` is close to `max_size`. The fix corrects the comparison to `msg->max_size - AJP_HEADER_LEN` so that the total data (header + body) never exceeds the buffer capacity. Patch landed 9 days 8 hours 34 minutes before CVE-2026-28780 was published. high confirmed CVE-2026-28780 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/144 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/144 Sun, 26 Apr 2026 16:00:19 GMT Before the patch, `ajp_parse_data` computed `expected_len = msg->len - (AJP_HEADER_LEN + AJP_HEADER_SZ_LEN + 1 + 1)` without first verifying that `msg->len` is large enough. If a malicious AJP backend sends a crafted message with `msg->len` smaller than the constant subtrahend (e.g., msg->len = 0 or very small), the subtraction wraps around to a large positive value (integer/size_t underflow). This incorrect `expected_len` is then compared against the caller-supplied `*len`, potentially allowing a malformed AJP DATA message to bypass length validation and cause subsequent out-of-bounds memory reads. The patch adds a guard that returns an error if the message is too small before performing the subtraction. Patch landed 7 days 23 hours 37 minutes before CVE-2026-34059 was published. high confirmed CVE-2026-34059 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/145 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/145 Sun, 26 Apr 2026 16:00:34 GMT The original check `size + start > msg->max_size` was incorrect in two ways: it compared against max_size (the allocated buffer capacity) rather than msg->len (the actual data length), and used strict greater-than rather than greater-than-or-equal. This allowed a malicious AJP backend to send a crafted AJP message where the string size field indicates more bytes than are actually present in the message, causing Apache httpd to read beyond valid message data. The patch corrects the bounds check to use msg->len and also verifies the required null terminator is present at the expected position. Patch landed 7 days 23 hours 40 minutes before CVE-2026-34032 was published. high confirmed CVE-2026-34032 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/146 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/146 Sun, 26 Apr 2026 16:00:47 GMT The AJP message parsing functions in Apache httpd used incorrect boundary checks (> instead of >=), allowing a read of exactly one byte beyond the valid message buffer. For example, ajp_msg_get_uint8 and ajp_msg_peek_uint8 used `msg->pos > msg->len` when they should use `>=`, meaning when pos == len (pointing just past the last byte) the check would pass and a byte at msg->buf\[msg->len\] would be read out of bounds. Similarly, ajp_msg_get_uint16/peek_uint16 allowed reading 2 bytes when only 1 remained, and ajp_msg_get_uint32 allowed reading 4 bytes when only 3 remained. A malicious AJP backend could craft a response that exploits this to cause an out-of-bounds read. Patch landed 7 days 23 hours 43 minutes before CVE-2026-33857 was published. medium confirmed CVE-2026-33857 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/138 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/138 Fri, 24 Apr 2026 15:31:32 GMT The UpdateAdminConfiguration function used xorm's fluent Where+Update(struct) pattern, but xorm resolves the target row by primary key when a struct is passed to Update(), silently ignoring the WHERE org_id clause. This caused all rows in the ngalert_configuration table to be updated when multiple organizations existed, allowing one org's configuration update to overwrite alert routing settings for all other orgs. The fix fetches the existing row first to get its primary key, then uses .ID() to scope the UPDATE to exactly that one record. high confirmed CVE-2026-21727 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/135 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/135 Thu, 23 Apr 2026 10:55:32 GMT The NO_PROXY environment variable's leading-dot suffix matching was too permissive: `NO_PROXY=.example.com` would match any hostname ending in `example.com`, including `notexample.com` or `badexample.com`. This means an attacker-controlled hostname like `evilexample.com` could bypass proxy restrictions that were intended only for subdomains of `example.com`. The fix ensures that the dot-separated boundary is properly checked by requiring either an exact match or that the character before the suffix starts with a dot. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/131 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/131 Wed, 22 Apr 2026 17:05:43 GMT Small typed arrays (e.g., Int8Array, Float32Array with few elements) in V8 may not have a backing store allocated until their corresponding ArrayBuffer is explicitly accessed. Before the patch, calling GetRawPointer with such a small TypedArray would return a pointer into arbitrary stack memory (the in-heap representation) rather than a valid heap buffer. An attacker could use this to leak stack memory addresses or read arbitrary stack data via the FFI interface. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/162 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/162 Wed, 29 Apr 2026 18:26:11 GMT Before the patch, functions like ap_escape_shell_cmd, ap_escape_path_segment, ap_os_escape_path, and ap_escape_urlencoded computed buffer sizes by multiplying strlen() by 2 or 3 without checking for integer overflow. On systems where apr_size_t is 64-bit but malloc/palloc internally uses size_t arithmetic, an extremely large string (e.g., ~(SIZE_MAX/3) bytes) could cause the multiplication to overflow, resulting in apr_palloc allocating a much smaller buffer than needed, leading to a heap buffer overflow when the escape functions write beyond the allocated buffer. The patch adds ap_assert checks to ensure the multiplication cannot overflow APR_SIZE_MAX before calling apr_palloc. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/126 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/126 Mon, 30 Mar 2026 17:16:08 GMT The compiler playground parsed user-supplied config overrides using `new Function(...)`, which executes arbitrary JavaScript code in the browser context. An attacker could craft a malicious URL with a base64/encoded config payload containing arbitrary JS, which when shared and opened by a victim, would execute the attacker's code in the victim's browser. The patch replaces `new Function(...)` with JSON5 parsing, which only allows data literals and rejects executable code. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/125 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/125 Mon, 30 Mar 2026 12:36:49 GMT The OFREP endpoint's `validateNamespace` function used `io.ReadAll(r.Body)` without any size limit, allowing an attacker to send arbitrarily large request bodies that would be fully read into memory. This could exhaust server memory and cause a denial of service. The fix applies `http.MaxBytesReader` to limit the body to 1 MiB before reading. medium confirmed CVE-2026-27880 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/124 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/124 Sun, 29 Mar 2026 12:03:25 GMT When an ArrayBufferView backed by a zero-length ArrayBuffer (which has a null backing store data pointer) is passed to crypto functions like cipher.update(), the code unconditionally dereferenced the buffer's data pointer without checking for null. This caused a process crash (SIGSEGV/access violation). The patch adds a null check so that when buf_data is null, stack_storage_ is used as a fallback, preventing the crash. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/123 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/123 Fri, 27 Mar 2026 14:45:04 GMT The fill resampling feature in Grafana's SQL datasources (MySQL, PostgreSQL, MSSQL) could be exploited to cause excessive memory allocation. By crafting a query with a very large time range and a very small fill interval (e.g., time range spanning years with millisecond intervals), an attacker could trigger `sqlutil.ResampleWideFrame` to allocate an enormous number of data points, exhausting server memory and causing a denial of service. The patch adds a guard that skips the fill operation if the number of fill points would exceed the configured row limit. Patch landed 87 days 3 hours 56 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/122 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/122 Fri, 27 Mar 2026 08:29:30 GMT When a user creates a Kubernetes resource containing inline secure values (raw secrets) via kubectl apply, the kubectl client automatically stores the full object including the raw secret value in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This annotation is persisted in the API server and can be read back by anyone with read access to the resource, effectively leaking the raw secret value. The patch clears this annotation when a raw secret is detected in the inline secure values section, preventing the secret from being stored in plaintext in the annotation. Patch landed 87 days 10 hours 18 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/121 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/121 Thu, 26 Mar 2026 22:22:17 GMT The Reset() method in Node.js's zlib binding did not check the write_in_progress_ flag before resetting the compression stream. This allowed calling reset() while an async write was being processed by a worker thread, causing the internal zlib/brotli state to be freed while still in use, resulting in a use-after-free condition that could lead to memory corruption or process crash. The fix adds a guard that throws an error if a write is in progress, consistent with how Close() and Write() already behave. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/120 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/120 Thu, 26 Mar 2026 09:05:25 GMT Before this patch, the Kubernetes-style IAM API endpoint `/apis/iam.grafana.app/v0alpha1/namespaces/{ns}/users/{name}/teams` used the generic `ResourceAuthorizer` which only checked `get` permission on the `users` resource itself, but did not properly enforce the `teams` subresource authorization. According to the commit, the RBAC service would ignore the 'teams' subresource check, meaning any user with generic `users:read` permission could potentially access team membership data for users they shouldn't be able to see. The patch adds a dedicated `UserAuthorizer` that explicitly checks `get` permission on the parent user when the `teams` subresource is requested. Patch landed 88 days 9 hours 53 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/119 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/119 Wed, 25 Mar 2026 16:21:48 GMT The `/api/alertmanager/grafana/api/v2/status` endpoint was protected by the `alert.notifications:read` permission, which is granted to Viewers and Editors by default. This allowed any authenticated user (including low-privileged Viewers) to access Alertmanager system status information including routing configuration, receivers configuration, and other sensitive system details. The patch replaces this with a new dedicated `alert.notifications.system-status:read` permission that is only granted to Admin users. Patch landed 89 days 2 hours 41 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/118 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/118 Wed, 25 Mar 2026 14:48:37 GMT Before the patch, the `validateWriteAccess` function did not handle `JobActionFixFolderMetadata` in its switch statement, meaning it fell through to the `default` case which applies no ref-based restriction. This allowed users to trigger a fix-folder-metadata job that would write directly to the default/main branch even when the repository was configured with only a 'branch' workflow (meaning the default branch should be read-only). The patch adds the missing case to extract the target ref from `FixFolderMetadata.Ref` and apply proper write permission checks. Patch landed 89 days 4 hours 2 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/109 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/109 Tue, 24 Mar 2026 22:55:39 GMT V8's array index hash values for numeric strings were predictable because they directly encoded the integer value and string length without randomization. Consecutive numeric string keys (e.g., '0', '1', '2', ...) would have consecutive hash values, allowing an attacker to craft inputs that cause O(n^2) hash table probe collisions. This patch adds seeded scrambling of the 24-bit array-index value in Name's raw_hash_field using a 3-round xorshift-multiply scheme with random secrets derived from rapidhash, preventing an attacker from predicting hash distributions. This is tracked as CVE-2026-21717. Patch landed 5 days 22 hours 41 minutes before CVE-2026-21717 was published. high confirmed CVE-2026-21717 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/110 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/110 Tue, 24 Mar 2026 22:55:57 GMT A malicious HTTP/2 client could send a WINDOW_UPDATE frame on stream 0 (connection level) with an increment that pushes the flow-control window past 2^31-1. nghttp2 internally responds with GOAWAY(FLOW_CONTROL_ERROR) but Node.js's OnInvalidFrame callback did not handle NGHTTP2_ERR_FLOW_CONTROL, so the Http2Session was never destroyed, causing a memory leak. An attacker can exploit this to exhaust server memory by repeatedly opening connections and sending the malicious frame, enabling denial of service. Patch landed 5 days 22 hours 43 minutes before CVE-2026-21714 was published. high confirmed CVE-2026-21714 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/111 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/111 Tue, 24 Mar 2026 22:56:15 GMT The Web Cryptography API's HMAC and KMAC `verify` operations used the non-constant-time `memcmp` function to compare the computed MAC against the provided signature. This allowed timing-based side-channel attacks where an attacker could measure response times to infer byte-by-byte information about the expected MAC value. The patch replaces `memcmp` with `CRYPTO_memcmp`, which executes in constant time regardless of where the comparison fails. Patch landed 5 days 22 hours 43 minutes before CVE-2026-21713 was published. medium confirmed CVE-2026-21713 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/112 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/112 Tue, 24 Mar 2026 22:56:32 GMT When `headersDistinct` or `trailersDistinct` was accessed on an IncomingMessage, the destination object was initialized as a plain `{}` which inherits from `Object.prototype`. If a request included a `__proto__` header, `dst\["__proto__"\]` would resolve to `Object.prototype` (a truthy object rather than undefined), causing `_addHeaderLineDistinct` to call `.push()` on `Object.prototype` instead of an array, throwing an uncaught TypeError that crashes the Node.js process. The fix uses `{ __proto__: null }` to create a null-prototype object, preventing prototype chain lookups. Patch landed 5 days 22 hours 43 minutes before CVE-2026-21710 was published. high confirmed CVE-2026-21710 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/113 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/113 Tue, 24 Mar 2026 22:56:45 GMT Node.js's permission model (--permission flag) failed to enforce network access controls for Unix Domain Socket (UDS) connections and server listeners via pipe_wrap.cc. Before the patch, calling net.createServer().listen('/tmp/sock') or net.connect({path:'/tmp/sock'}) would succeed even when --allow-net was not granted, bypassing the intended permission restrictions. The patch adds THROW_IF_INSUFFICIENT_PERMISSIONS checks to PipeWrap::Bind and PipeWrap::Listen to enforce the kNet permission scope. Patch landed 5 days 22 hours 44 minutes before CVE-2026-21711 was published. medium confirmed CVE-2026-21711 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/114 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/114 Tue, 24 Mar 2026 22:57:03 GMT Before the patch, if an SNICallback function threw a synchronous exception during TLS handshake processing in loadSNI(), the exception would propagate as an uncaught exception, crashing the Node.js process. The patch wraps the owner._SNICallback() invocation in a try/catch block, routing any thrown exceptions through owner.destroy() instead. A remote unauthenticated attacker can crash any Node.js TLS server by sending a TLS ClientHello with a crafted server_name value that causes the SNICallback to throw. high confirmed CVE-2026-21637 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/115 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/115 Tue, 24 Mar 2026 22:57:15 GMT Before the patch, `url.format()` called `CHECK(out)` after attempting to re-parse a URL string with `ada::parse<ada::url>`. If the URL (originally parsed by `ada::url_aggregator`) could not be re-parsed by `ada::url` (e.g., special scheme URLs with opaque paths like `ws:xn-ȫ`), the CHECK macro would trigger an abort/crash of the Node.js process. The patch replaces the hard crash with a graceful fallback that returns the original href unmodified. Patch landed 5 days 19 hours 44 minutes before CVE-2026-21712 was published. high confirmed CVE-2026-21712 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/116 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/116 Tue, 24 Mar 2026 22:57:35 GMT The Node.js Permission Model (introduced with --experimental-permission flag) did not enforce filesystem read/write permission checks on several `fs/promises` API functions including `lstat`, `fchmod`, and `fchown`. This allowed an attacker to bypass the permission model by using the promise-based filesystem API instead of the callback/sync APIs, which did have proper permission checks. The patch adds the missing permission checks to `lstat` (read permission) and disables `fchmod`/`fchown` entirely when the Permission Model is enabled. Patch landed 5 days 22 hours 44 minutes before CVE-2026-21716 was published. high confirmed CVE-2026-21716 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/117 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/117 Tue, 24 Mar 2026 22:57:48 GMT The Node.js Permission Model's `--allow-fs-read` restriction could be bypassed by using `fs.realpath.native()` instead of `fs.realpath()`. Before the patch, `RealPath` in node_file.cc lacked permission checks for both the async and sync code paths, allowing an attacker to read/resolve file paths that should be blocked by the permission model. The patch adds `ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS` and `THROW_IF_INSUFFICIENT_PERMISSIONS` checks to enforce the `kFileSystemRead` permission scope. Patch landed 5 days 22 hours 44 minutes before CVE-2026-21715 was published. high confirmed CVE-2026-21715 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/104 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/104 Tue, 24 Mar 2026 15:49:30 GMT In the nginx stream SSL module, the OCSP (Online Certificate Status Protocol) certificate revocation check was not being performed during client certificate validation. The code would verify the certificate chain but skip the OCSP status check, allowing clients with revoked certificates to successfully authenticate. The patch adds the missing `ngx_ssl_ocsp_get_status()` call that properly checks and enforces OCSP certificate revocation status. Patch landed 2 minutes before CVE-2026-28755 was published. high confirmed CVE-2026-28755 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/100 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/100 Tue, 24 Mar 2026 14:48:12 GMT When authenticating with CRAM-MD5 or APOP methods, the code set `s->passwd.data = NULL` but did not reset `s->passwd.len`. On a subsequent authentication attempt, the non-zero length would cause the code to attempt to use the null pointer as if it pointed to valid password data, resulting in a null pointer dereference and worker process crash. The fix uses `ngx_str_null(&s->passwd)` which correctly zeroes both the data pointer and the length. Patch landed 43 minutes before CVE-2026-27651 was published. medium confirmed CVE-2026-27651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/101 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/101 Tue, 24 Mar 2026 14:48:33 GMT Before the patch, when nginx's mail module resolved a client's IP address to a hostname, it used the resolved hostname without validation in auth_http requests and SMTP proxy communications. An attacker controlling DNS responses could return a hostname containing newlines, spaces, or other special characters, enabling injection of arbitrary headers into auth_http requests or arbitrary SMTP commands into the proxied SMTP session. The patch validates that the resolved hostname only contains RFC 1034-compliant characters (letters, digits, hyphens, dots). Patch landed 44 minutes before CVE-2026-28753 was published. high confirmed CVE-2026-28753 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/102 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/102 Tue, 24 Mar 2026 14:48:53 GMT When nginx WebDAV module (ngx_http_dav_module) processed COPY or MOVE requests with an alias directive configured, supplying a Destination header with a URI shorter than the alias prefix caused an integer underflow in ngx_http_map_uri_to_path(). The underflow resulted in a heap buffer overwrite, which could allow an attacker to manipulate source or destination file paths to be outside the configured location root (path traversal via memory corruption). The patch adds a validation check that rejects Destination URIs shorter than the alias length before the vulnerable path mapping occurs. Patch landed 45 minutes before CVE-2026-27654 was published. high confirmed CVE-2026-27654 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/103 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/103 Tue, 24 Mar 2026 14:49:11 GMT On 32-bit platforms, multiplying a uint32_t `entries` value by the size of a struct (also size_t/32-bit) could overflow before being compared to the uint64_t `atom_data_size`. This allowed an attacker to craft a malicious MP4 file with a large entries count that, after overflow, appeared to pass the size validation check, causing nginx to process entries beyond the allocated buffer boundaries with out-of-bounds reads and writes. The fix casts `entries` to uint64_t before multiplication to prevent the overflow. Patch landed 45 minutes before CVE-2026-27651 was published. high confirmed CVE-2026-27651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/99 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/99 Tue, 24 Mar 2026 14:23:08 GMT The nginx mp4 module had off-by-one errors in bounds checking for stco and co64 atoms. When `trak->start_chunk` equaled `trak->chunks` (i.e., pointing exactly past the end of the chunks array), the old check `trak->start_chunk > trak->chunks` would pass, allowing out-of-bounds memory access. Similarly, empty stsz sample arrays could be processed leading to buffer overread/overwrite. The patch changes `>` to `>=` to properly reject these boundary cases. Patch landed 1 hour 18 minutes before CVE-2026-27651 was published. high confirmed CVE-2026-27651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/98 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/98 Mon, 23 Mar 2026 22:25:24 GMT Before the patch, an attacker could send an HTTP Range request with an arbitrarily large byte range (e.g., 'bytes=0-' on a large file) and the server would attempt to download and buffer the entire requested range into memory before sending it. This could exhaust server memory and cause a denial of service. The patch adds a `ranges_valid?` check that rejects any byte ranges whose total size exceeds 100MB (configurable via `ActiveStorage.streaming_chunk_max_size`). high confirmed CVE-2026-33174 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/97 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/97 Mon, 23 Mar 2026 22:25:09 GMT The ActiveStorage streaming controller allowed multi-range HTTP byte range requests without limiting the number of ranges. An attacker could send a request with thousands of byte ranges, causing the server to download and assemble many chunks from storage in memory, exhausting server resources and potentially causing a DoS. The patch adds a configurable `streaming_max_ranges` limit (defaulting to 1) that rejects requests with more ranges than allowed. Patch landed 1 day 22 hours 43 minutes before CVE-2026-33658 was published. high confirmed CVE-2026-33658 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/96 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/96 Mon, 23 Mar 2026 22:24:56 GMT BigDecimal in Ruby supports scientific notation (e.g., '9e99999999'), allowing an attacker to pass a short string that causes BigDecimal to allocate an enormous amount of memory when converting the number. Before the patch, any user-controlled string passed to number helper functions (like number_to_currency or number_to_percentage) could trigger this via BigDecimal(number). The patch rejects strings containing 'e' or 'd' (scientific notation indicators) before attempting BigDecimal conversion. high confirmed CVE-2026-33176 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/95 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/95 Mon, 23 Mar 2026 22:24:41 GMT Before the patch, users could set protected metadata keys (analyzed, identified, composed) during a direct upload by including them in the metadata parameter. These keys control internal Active Storage state (e.g., whether a blob has been analyzed or identified), so a malicious user could set 'analyzed: true' or 'identified: true' to bypass file analysis/identification steps that might enforce security policies. The patch filters out these protected keys from user-supplied metadata in create_before_direct_upload!. medium confirmed CVE-2026-33173 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/94 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/94 Mon, 23 Mar 2026 22:24:27 GMT The `SafeBuffer#%` method failed to preserve the unsafe status of a SafeBuffer when used for string formatting. Before the patch, formatting an unsafe SafeBuffer (one that had been marked unsafe after mutation via gsub!, etc.) would return a new SafeBuffer that was incorrectly marked as html_safe?, allowing unescaped user input to be rendered as raw HTML. The fix propagates the `@html_unsafe` flag to the result of `%` formatting. medium confirmed CVE-2026-33170 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/93 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/93 Mon, 23 Mar 2026 22:23:58 GMT ActiveStorage's DiskService allowed path traversal via blob keys containing segments like '../../etc/passwd'. The `path_for` method directly joined the root directory with user-controlled key values without validating that the resolved path stayed within the storage root, allowing attackers to read or write arbitrary files on the server filesystem. The patch adds validation that rejects keys with dot segments and verifies the resolved path remains within the storage root directory. high confirmed CVE-2026-33195 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/92 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/92 Mon, 23 Mar 2026 22:23:41 GMT Before the patch, `DiskService#delete_prefixed` passed a user-influenced blob key directly into `Dir.glob` without escaping glob metacharacters. If a blob key contained characters like `*`, `?`, `\[`, `\]`, `{`, or `}`, the glob expansion could match and delete unintended files on the filesystem. The patch escapes all glob metacharacters in the resolved path before passing it to `Dir.glob`. medium confirmed CVE-2026-33202 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/91 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/91 Mon, 23 Mar 2026 22:23:25 GMT When a blank string is used as an HTML attribute name in Rails Action View tag helpers, `xml_name_escape` returns an empty string, producing malformed HTML like `<img src="/safe.png" ="/onerror=alert(1)">`. This malformed HTML can be parsed differently by different HTML parsers, enabling mutation XSS attacks where a browser's HTML parser interprets the malformed attribute as executable code. The patch fixes this by skipping blank attribute keys before they are rendered into HTML. high confirmed CVE-2026-33168 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/90 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/90 Mon, 23 Mar 2026 22:23:09 GMT The debug exceptions layout template used `raw` to output the exception message inside a `<script type="text/plain">` tag without HTML escaping. An attacker who can trigger an exception with a crafted message containing HTML/JavaScript could inject arbitrary script tags that would be rendered in the browser. The patch removes `raw` to use default ERB HTML escaping, ensuring special characters like `<`, `>` are escaped. medium confirmed CVE-2026-33167 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/89 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/89 Fri, 20 Mar 2026 23:04:40 GMT Before this patch, the GET /api/alertmanager/grafana/config/api/v1/alerts endpoint (which returns the raw Alertmanager configuration blob, potentially containing sensitive credentials like SMTP passwords, webhook secrets, and API tokens) was accessible to any user with the broad 'alert.notifications:read' permission, which was granted to Viewers and Editors. Similarly, GET /config/history and POST /config/history/{id}/_activate were accessible to users with alert.notifications:read/write. The patch restricts these endpoints to admin-only via new fine-grained RBAC actions (alert.notifications.config-history:read/write). Patch landed 93 days 19 hours 31 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/86 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/86 Thu, 19 Mar 2026 11:55:47 GMT The Grafana short URL feature allowed authenticated users to create short URLs with arbitrary target paths, including external URLs like `http://evil.com` or protocol-relative URLs like `//evil.com`. When a victim clicked a Grafana short URL, they would be silently redirected to the attacker-controlled external domain. The patch adds validation at both creation time and redirect time to ensure paths are always relative and cannot contain schemes, protocol-relative prefixes, or other external URL patterns. Patch landed 95 days 6 hours 49 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/83 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/83 Wed, 18 Mar 2026 11:30:36 GMT Before the patch, a resource manager could be changed directly from one manager to another (e.g., from repo:abc to terraform:xyz) in a single update operation without going through a remove-then-add workflow. This allowed one management system (e.g., Terraform) to silently take over resources managed by another system (e.g., a Git repository), potentially leading to unauthorized control over managed resources and unpredictable reconciliation conflicts. The patch adds an explicit check that blocks any update where both old and new objects have a manager set but with different values, returning HTTP 403. Patch landed 96 days 7 hours 16 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/82 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/82 Tue, 17 Mar 2026 23:42:42 GMT Before this patch, the Grafana Live push endpoint (`/api/live/push/:streamId`) had no RBAC authorization check, allowing any authenticated user (including Viewers) to push metrics and events to Grafana Live streams. The patch adds an `authorize(ac.EvalPermission(ac.ActionLivePush))` middleware that restricts this endpoint to users with the `live:push` permission (granted to Editors and Admins by default). Patch landed 96 days 19 hours 5 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/81 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/81 Tue, 17 Mar 2026 23:13:17 GMT Before this patch, Next.js development servers only warned (but did not block) cross-origin requests to internal dev assets and endpoints (/_next/*, /__nextjs*) when `allowedDevOrigins` was not configured. An attacker could craft a malicious webpage that loads or interacts with internal dev-only resources (HMR WebSocket, error feedback endpoints, internal chunks) from any origin. The patch changes the default behavior from warn-only to blocking with a 403 response, preventing unauthorized cross-origin access to dev server internals. medium confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/80 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/80 Tue, 17 Mar 2026 19:06:19 GMT The MSSQL connection string was built by directly concatenating the username and password without escaping special characters. Since semicolons are used as key-value delimiters in the connection string, a password containing a semicolon would be truncated at the semicolon, allowing authentication bypass or connection to unintended databases. For example, a password like `StrongPass;database=other` would cause the driver to parse `database=other` as a separate connection string parameter. Patch landed 96 days 23 hours 58 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/79 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/79 Tue, 17 Mar 2026 15:19:41 GMT The provisioning API's `UpdateContactPoint` endpoint did not perform authorization checks for protected fields (e.g., webhook URLs, API keys) before the patch. Any user with access to the provisioning API could modify protected/sensitive fields in contact points without the required `receivers:update.protected` permission, bypassing the security controls enforced by the regular receiver API. The patch adds a `checkProtectedFields` method that verifies the user has appropriate permissions before allowing modifications to protected fields. Patch landed 9 days 6 hours 25 minutes before CVE-2026-21724 was published. high confirmed CVE-2026-21724 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/78 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/78 Tue, 17 Mar 2026 11:03:07 GMT The `$B` (Blob) case in `parseModelString` did not validate that the FormData entry was actually a Blob before returning it. Since `FormData.get()` can return either a string or a Blob/File, an attacker could craft a malformed Server Action payload that stores a large string under a key and references it via `$B`, bypassing the `bumpArrayCount` size guard that applies to regular string values. The patch adds an `instanceof Blob` check that throws an error if the backing entry is not a real Blob, closing this bypass. While the PR notes this doesn't produce meaningful amplification on its own, it is a defense-in-depth fix against potential combined attacks. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/76 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/76 Tue, 17 Mar 2026 02:21:01 GMT Before the patch, when the `Origin` header was set to the string `'null'` (which browsers send from privacy-sensitive contexts like sandboxed iframes), Next.js would skip the CSRF origin check entirely because the code treated `'null'` as a missing/invalid origin and fell through without validation. This allowed an attacker to embed a sandboxed iframe that submits a Server Action cross-origin with user credentials (cookies) attached, bypassing CSRF protection. The patch now treats `'null'` as a valid but opaque origin and checks it against the `allowedOrigins` allowlist, blocking unauthorized cross-origin Server Action submissions from sandboxed contexts. Patch landed 13 hours 32 minutes before CVE-2026-27978 was published. high confirmed CVE-2026-27978 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/77 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/77 Tue, 17 Mar 2026 02:21:23 GMT The commit patches the compiled `http-proxy` / `follow-redirects` library bundled in Next.js, referencing security advisory GHSA-ggv3-7p47-pfv8. The vulnerability involves improper handling of HTTP redirects in the `follow-redirects` library, which could allow an attacker to manipulate redirect targets to leak sensitive request headers (such as Authorization) to unintended hosts or bypass security controls via crafted redirect responses. The patch updates the compiled bundle with fixes to the redirect handling logic. Patch landed 14 hours 35 minutes before CVE-2026-29057 was published. high confirmed CVE-2026-29057 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/75 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/75 Tue, 17 Mar 2026 00:49:23 GMT Before the patch, WebSocket connections to Next.js dev server endpoints (e.g., /_next/webpack-hmr) were accepted from privacy-sensitive origins (e.g., pages served with 'sandbox' CSP that sets origin to null). The old code only blocked requests when rawOrigin was truthy AND not equal to 'null', meaning requests with origin header 'null' (sent by sandboxed iframes/pages) bypassed origin validation entirely. The patch fixes this by treating a 'null' origin as a defined but non-allowed origin, causing such requests to be blocked. Patch landed 14 hours 47 minutes before CVE-2026-27977 was published. high confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/74 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/74 Mon, 16 Mar 2026 23:39:58 GMT Before this patch, the Kubernetes API endpoints for dashboard snapshots (GET, LIST, DELETE, POST /create, DELETE /delete/{deleteKey}, GET /settings) used a default `ServiceAuthorizer` that did not enforce RBAC permissions for snapshot resources. Any authenticated user, regardless of their assigned permissions, could read, list, create, and delete snapshots. The patch adds a `SnapshotAuthorizer` that maps K8s verbs to Grafana RBAC actions (`snapshots:read`, `snapshots:create`, `snapshots:delete`) and applies RBAC checks to the custom HTTP routes as well. Patch landed 97 days 19 hours 3 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/73 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/73 Mon, 16 Mar 2026 19:56:58 GMT Public dashboard CRUD endpoints (Delete, Update, ExistsEnabledByDashboardUid) were only checking the user's role/permissions but not validating that the public dashboard being operated on belonged to the same organization as the requesting user. This allowed an authenticated user with Editor+ permissions in Org B to delete, update, or check the existence of public dashboards belonging to Org A, without having access to the source dashboard. The patch adds org_id checks to all relevant database queries to enforce org isolation. Patch landed 97 days 22 hours 39 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/69 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/69 Fri, 06 Mar 2026 06:01:47 GMT When pipelined HTTP requests arrive in a single TCP segment, llhttp_execute() processes all of them in one call. If a synchronous 'close' event handler calls freeParser() mid-execution, cleanParser() nulls out parser state while llhttp_execute() is still on the call stack, causing use-after-free/null-pointer dereference crashes on subsequent callbacks. The patch adds an is_being_freed_ flag that causes the Proxy::Raw callback to return early (HPE_USER) when set, aborting llhttp_execute() before it accesses freed/nulled parser state. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/65 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/65 Tue, 03 Mar 2026 14:31:34 GMT In multi-threaded Django applications, the file-based cache backend and filesystem storage used temporary umask changes (via os.umask()) to control directory permissions when creating directories. Because os.umask() is a process-wide operation, a temporary umask change in one thread could affect directory/file creation in other threads, resulting in file system objects being created with unintended (potentially overly permissive) permissions. The patch replaces the umask manipulation approach with a safe_makedirs() function that uses os.chmod() after os.mkdir() to enforce the exact requested permissions. Patch landed 3 hours 22 minutes before CVE-2026-25674 was published. low confirmed CVE-2026-25674 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/66 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/66 Tue, 03 Mar 2026 14:31:49 GMT Django's URLField.to_python() used urlsplit() to detect URL schemes, which on Windows performs NFKC Unicode normalization. This normalization is disproportionately slow for inputs containing certain Unicode characters (e.g., characters like '¾'), allowing an attacker to craft a POST payload that causes excessive CPU consumption. The patch replaces urlsplit() with str.partition(':') for scheme detection, avoiding Unicode normalization entirely. Patch landed 3 hours 22 minutes before CVE-2026-25673 was published. medium confirmed CVE-2026-25673 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/64 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/64 Mon, 02 Mar 2026 19:13:15 GMT The `path` property on `ClientRequest` was only validated against `INVALID_PATH_REGEX` at construction time. After construction, an attacker (or vulnerable application code) could reassign `req.path` to include CRLF sequences (`\\r\\n`), which would then be flushed verbatim to the socket in `_implicitHeader()`, allowing injection of arbitrary HTTP headers or request smuggling. The patch adds a getter/setter using a symbol-backed property so validation runs on every assignment. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/63 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/63 Mon, 02 Mar 2026 13:23:35 GMT The `writeEarlyHints()` function in Node.js HTTP server directly concatenated user-supplied header names and values into the raw HTTP/1.1 response without any validation. Unlike `setHeader()` and `writeHead()`, no calls to `validateHeaderName()`, `validateHeaderValue()`, or `checkInvalidHeaderChar()` were made, allowing CRLF sequences to pass through unchecked and inject arbitrary HTTP headers or entire responses. The patch adds proper validation for header names, values, and Link header URLs. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/60 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/60 Fri, 27 Feb 2026 18:45:58 GMT Before the patch, Buffer.concat() computed the total allocation size using the user-controllable `.length` property of each element, then allocated with `Buffer.allocUnsafe(length)`. For typed arrays, an attacker could spoof a larger `.length` via a getter, causing an oversized uninitialized Buffer to be returned, leaking process memory contents. The patch fixes this by using the typed array’s intrinsic byte length (`TypedArrayPrototypeGetByteLength`) and by allocating via `allocate` plus explicit zero-filling of any slack. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/58 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/58 Fri, 27 Feb 2026 15:44:07 GMT Before the patch, the QUIC OpenSSL compatibility keylog callback discarded failures from ngx_quic_compat_set_encryption_secret(). Under memory pressure (allocation failure), the encryption context (secret->ctx) could remain NULL, yet ngx_quic_compat_create_record() would proceed to encrypt and dereference the NULL ctx, crashing the NGINX worker. The patch checks the return value, marks the QUIC connection as errored to fail the handshake cleanly, and adds a NULL guard in record creation to prevent the crash. Patch landed 24 days 23 hours 55 minutes before CVE-2026-27651 was published. high confirmed CVE-2026-27651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/59 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/59 Fri, 27 Feb 2026 15:44:28 GMT Before the patch, the QUIC stateless reset token was derived only from a shared secret and the connection ID, making the token identical across workers. In a multi-worker configuration with packet steering, an attacker could intentionally route a victim connection's packet to a different worker to trigger emission/observation of the stateless reset token, then forge a QUIC Stateless Reset to immediately terminate the victim connection (remote DoS). The patch binds the derived token to the worker number by incorporating ngx_worker into the KDF input, making tokens differ per worker and preventing cross-worker token acquisition/abuse. Patch landed 25 days before CVE-2026-27651 was published. high confirmed CVE-2026-27651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/57 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/57 Thu, 26 Feb 2026 14:22:19 GMT Before the patch, `ProcessEnv::read_all()` returned a serializable `EnvMap`, which could be automatically persisted into Turbopack/Next.js' on-disk persistent cache. This meant any process environment variable (including secrets like API keys and tokens) could be written to disk and later recovered by anyone with read access to the cache directory (e.g., another local user, CI artifact consumers, or a compromised build agent). The patch introduces `TransientEnvMap` with `serialization = "none"` and changes `read_all()` to return it, preventing env vars from being persisted and forcing them to be re-read from the process environment after cache restore. Patch landed 19 days 1 hour 18 minutes before CVE-2026-27977 was published. high confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/56 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/56 Thu, 26 Feb 2026 14:19:34 GMT Before the patch, nginx would generate and send a QUIC Stateless Reset for every incoming packet that triggered the stateless reset path, with no per-source rate limiting. An attacker could spoof many UDP packets (often with spoofed source IPs) to force the server to spend CPU on hashing/random generation and to emit many Stateless Reset packets, creating resource exhaustion and reflected traffic. The patch adds a per-second Bloom-filter-based limiter keyed by source address so repeated triggers from the same address are declined. Patch landed 76 days 4 hours 25 minutes before CVE-2026-40460 was published. medium confirmed CVE-2026-40460 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/55 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/55 Tue, 24 Feb 2026 20:59:12 GMT The markdown conversion functionality was vulnerable to XSS attacks through malicious javascript: URLs that could bypass protocol filtering using obfuscation techniques like leading whitespace, HTML entity encoding, or case variations. The patch fixes this by delegating URI validation to Rails::HTML::Sanitizer.allowed_uri? which properly handles these bypass attempts. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/53 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/53 Tue, 24 Feb 2026 19:55:06 GMT The code failed to check if BIO_meth_new() returns NULL before passing the result to BIO_meth_set_* functions, causing a null pointer dereference. This could lead to application crashes and potential denial of service when SSL/TLS operations are initiated under memory pressure conditions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/47 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/47 Mon, 23 Feb 2026 10:32:22 GMT The ValidateRedirectTo function was vulnerable to open redirect attacks through URL fragments. Attackers could bypass path validation by using URL fragments containing dangerous patterns like '../' or '//', which were not sanitized before the redirect. The patch fixes this by validating fragments and returning a sanitized URL string instead of the original user input. Patch landed 119 days 8 hours 19 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/46 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/46 Mon, 23 Feb 2026 10:32:03 GMT The code failed to validate that sync sample values in MP4 stss atoms are 1-based as required by ISO 14496-12. A zero-valued stss entry caused the key_prefix calculation to exceed consumed samples, leading the backward loop in ngx_http_mp4_crop_stts_data() to walk past the beginning of the stts data buffer, causing out-of-bounds memory access. Patch landed 29 days 5 hours 19 minutes before CVE-2026-27651 was published. high confirmed CVE-2026-27651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/42 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/42 Fri, 20 Feb 2026 04:55:06 GMT The unhandled rejection filter module was being bundled twice, causing mutual recursion when handling unhandled Promise rejections. Each instance captured the other's handler, creating an infinite loop that would overflow the stack and crash the server on any unhandled rejection. Patch landed 25 days 10 hours 41 minutes before CVE-2026-27977 was published. medium confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/41 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/41 Thu, 19 Feb 2026 18:31:51 GMT The code was truncating SHA256 hashes to only 10 characters when generating secret names, dramatically increasing collision probability from negligible to ~1 in 16^10. This allows attackers to craft field names that collide with existing secret field names, potentially accessing or modifying secrets they shouldn't have access to. Patch landed 123 days 11 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/35 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/35 Thu, 19 Feb 2026 10:13:09 GMT The code had a fallback authentication mechanism that would allow any request to bypass authorization checks when the primary authenticator failed. The fallback would accept requests with only namespace validation, effectively allowing unauthorized access to resources. Patch landed 123 days 8 hours 28 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/37 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/37 Thu, 19 Feb 2026 17:05:03 GMT The session was not being marked as accessed when only reading operations like checking keys or length occurred, causing the 'Vary: Cookie' header to not be set. This could allow caching proxies to serve the same cached response to different users, potentially leaking session-dependent data between users. Patch landed 14 hours 49 minutes before CVE-2026-27205 was published. medium confirmed CVE-2026-27205 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/38 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/38 Thu, 19 Feb 2026 17:05:19 GMT The session was not being marked as accessed when only checking keys/metadata, allowing caching proxies to cache pages for different users. This could lead to session data being served to wrong users through shared caches. The patch fixes this by tracking session access at the request context level. Patch landed 17 hours 9 minutes before CVE-2026-27205 was published. medium confirmed CVE-2026-27205 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/39 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/39 Thu, 19 Feb 2026 17:05:30 GMT The session was not properly marked as accessed when only reading session metadata (keys, length checks), allowing responses to be cached without the Vary: Cookie header. This could lead to cache poisoning where one user's cached response is served to another user, potentially exposing session-dependent data. Patch landed 17 hours 42 minutes before CVE-2026-27205 was published. medium confirmed CVE-2026-27205 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/34 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/34 Wed, 18 Feb 2026 22:42:29 GMT The scope resolver cache was not invalidated when datasources were deleted, causing stale name-to-UID mappings. When a datasource was deleted and a new one created with the same name, the cached entry would resolve to the deleted datasource's UID, leading to incorrect authorization decisions. The patch fixes this by invalidating the cache entry for the datasource name scope during deletion. Patch landed 6 days 17 hours 5 minutes before CVE-2026-21725 was published. medium confirmed CVE-2026-21725 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/32 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/32 Wed, 18 Feb 2026 17:06:36 GMT The code had a missing size check for postponed request bodies in self-hosted setups, allowing attackers to send arbitrarily large payloads that would consume server memory and potentially crash the application. The patch ensures maxPostponedStateSize is consistently enforced across all code paths that buffer postponed bodies. Patch landed 26 days 23 hours 23 minutes before CVE-2026-27979 was published. medium confirmed CVE-2026-27979 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/31 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/31 Wed, 18 Feb 2026 12:05:51 GMT The audit logging configuration was exposing sensitive data source request and response bodies by default. This could lead to credentials, API keys, and sensitive query data being logged in plaintext audit files accessible to system administrators. Patch landed 124 days 6 hours 38 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/29 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/29 Tue, 17 Feb 2026 16:03:27 GMT The rolebindings API was accessible to all authenticated users without proper authorization checks. This allowed any user to potentially view, modify, or create role bindings, leading to privilege escalation. The patch restricts access to only access policy identities. Patch landed 125 days 2 hours 43 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/27 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/27 Tue, 17 Feb 2026 13:53:09 GMT The vulnerability allows attackers to cause a mismatch between the Content-Length header sent to SCGI backends and the actual request body size in unbuffered mode. This can lead to HTTP request smuggling or desynchronization between nginx and SCGI backends, potentially allowing request smuggling attacks. Patch landed 35 days 1 hour 45 minutes before CVE-2026-27651 was published. medium confirmed CVE-2026-27651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/24 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/24 Mon, 16 Feb 2026 14:33:20 GMT The code incorrectly assigned key functions for namespaced and cluster-scoped resources, causing namespaced resources to use cluster-scoped key functions and vice versa. This could allow unauthorized access to resources across namespace boundaries by manipulating resource keys. Patch landed 126 days 4 hours 5 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/22 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/22 Mon, 16 Feb 2026 10:04:29 GMT The endpoint allowed any authenticated user to access team member information without proper authorization checks. The patch adds a permission check requiring 'GetPermissions' verb on the Team resource before returning member data. Patch landed 126 days 8 hours 34 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/20 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/20 Mon, 16 Feb 2026 07:36:22 GMT The files API endpoints were not enforcing quota limits, allowing authenticated users to bypass resource quotas and create unlimited files/dashboards. This could lead to resource exhaustion and denial of service. The patch adds quota checks before allowing POST/PUT operations on files. Patch landed 126 days 11 hours 3 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/15 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/15 Fri, 13 Feb 2026 17:31:31 GMT A race condition in HTTP keep-alive socket reuse allowed responseKeepAlive() to be called twice, corrupting socket state and causing the agent to hand an already-assigned socket to multiple requests. This could cause requests to hang, timeout, or potentially leak data between requests sharing the same corrupted socket. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/14 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/14 Fri, 13 Feb 2026 16:47:01 GMT A Time-of-Check Time-of-Use race condition in worker thread process.cwd() caching allowed workers to cache stale directory values. The counter was incremented before the directory change completed, creating a race window where workers could read the old directory but cache it with the new counter value. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/10 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/10 Wed, 11 Feb 2026 12:26:10 GMT The code was vulnerable to Cross-Site Scripting (XSS) by directly rendering user-controlled data via dangerouslySetInnerHTML without sanitization. Malicious trace data could inject JavaScript that would execute in users' browsers. The patch fixes this by sanitizing HTML content with DOMPurify before rendering. Patch landed 21 hours 29 minutes before CVE-2025-41117 was published. medium confirmed CVE-2025-41117 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/11 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/11 Wed, 11 Feb 2026 12:26:16 GMT The vulnerability allows attackers to bypass time range restrictions on public dashboards when time selection is disabled. By manipulating request time parameters, attackers can access annotations outside the intended dashboard time range, potentially exposing sensitive data from unauthorized time periods. Patch landed 21 hours 29 minutes before CVE-2026-21722 was published. high confirmed CVE-2026-21722 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/9 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/9 Wed, 11 Feb 2026 00:53:34 GMT The code forwards arbitrary HTTP headers from incoming requests to outgoing gRPC calls without proper validation or sanitization. An attacker can inject malicious headers that could be used to bypass security controls, manipulate downstream services, or perform request smuggling attacks. Patch landed 44 days 14 hours 53 minutes before CVE-2026-27876 was published. medium confirmed CVE-2026-27876