Common Weakness Enumeration
CWE-288
AllowedAuthentication Bypass Using an Alternate Path or Channel
Abstraction: Base · Status: Incomplete
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
1295 vulnerabilities reference this CWE, most recent first.
CVE-2026-114732 (GCVE-0-2026-114732)
Vulnerability from cvelistv5 – Published: 2026-10-22 02:16 – Updated: 2026-10-22 02:16
VLAI
EPSS
VEX
Summary
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
Severity
6.8 (Medium)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://bugs.debian.org/1151279 | issue-trackingthird-party-advisory |
| https://github.com/roundcube/roundcubemail/commit… | patch |
| https://roundcube.net/news/2026/10/19/security-up… | vendor-advisoryrelease-notes |
| https://github.com/roundcube/roundcubemail/releas… | release-notespatch |
| https://github.com/roundcube/roundcubemail/releas… | release-notespatch |
| https://github.com/roundcube/roundcubemail/commit… | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Webmail",
"repo": "https://github.com/roundcube/roundcubemail/",
"vendor": "Roundcube",
"versions": [
{
"lessThan": "1.6.20",
"status": "affected",
"version": "1.6.0",
"versionType": "semver"
},
{
"lessThan": "1.7.5",
"status": "affected",
"version": "1.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.20",
"versionStartIncluding": "1.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.7.5",
"versionStartIncluding": "1.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit \u201cFix bug where an alias login wasn\u2019t qualified by IMAP host\u201d."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:16:51.833Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"issue-tracking",
"third-party-advisory"
],
"url": "https://bugs.debian.org/1151279"
},
{
"tags": [
"patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/453c413d6851cf603bebdb15e58381f5ef9b8094"
},
{
"tags": [
"vendor-advisory",
"release-notes"
],
"url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"
},
{
"tags": [
"patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-114732",
"datePublished": "2026-10-22T02:16:51.833Z",
"dateReserved": "2026-10-22T02:16:51.473Z",
"dateUpdated": "2026-10-22T02:16:51.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114635 (GCVE-0-2026-114635)
Vulnerability from cvelistv5 – Published: 2026-10-22 01:43 – Updated: 2026-10-22 01:43
VLAI
EPSS
VEX
Title
Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
Summary
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
Severity
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/traefik/traefik/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/traefik-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v2",
"product": "traefik",
"vendor": "traefik",
"versions": [
{
"lessThan": "2.11.58",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.11.58",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v3",
"product": "traefik",
"vendor": "traefik",
"versions": [
{
"lessThan": "3.7.14",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.11.58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.7.14",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dlorenc"
}
],
"datePublic": "2026-10-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T01:43:36.508Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fh26-gfpp-7xxx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx"
},
{
"name": "VulnCheck Advisory: Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-check-bypass-via-http-2-scheme"
}
],
"title": "Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114635",
"datePublished": "2026-10-22T01:43:36.508Z",
"dateReserved": "2026-10-21T21:57:36.197Z",
"dateUpdated": "2026-10-22T01:43:36.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111712 (GCVE-0-2026-111712)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:40 – Updated: 2026-10-16 18:19
VLAI
EPSS
VEX
Title
Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix
Summary
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:18 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/lukadqq/netcore-router-public-… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Impacted products
Date Public
2026-10-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111712",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:18:52.386910Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:19:03.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR256CN",
"vendor": "Netcore",
"versions": [
{
"lessThanOrEqual": "1.5.140116",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Lu Fangzhou"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
}
],
"datePublic": "2026-10-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:40:02.008Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-cgi-auth-bypass-alternate-path.md"
},
{
"name": "VulnCheck Advisory: Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-authentication-bypass-via-cgi-path-prefix"
}
],
"title": "Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111712",
"datePublished": "2026-10-16T17:40:02.008Z",
"dateReserved": "2026-10-16T14:31:23.358Z",
"dateUpdated": "2026-10-16T18:19:03.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111438 (GCVE-0-2026-111438)
Vulnerability from cvelistv5 – Published: 2026-10-19 08:08 – Updated: 2026-10-19 17:22
VLAI
EPSS
VEX
Title
check_hba_replication 认证与访问控制绕过
Summary
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。
此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:22 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-server |
Unaffected:
7.0.0-LTS
Affected: 3.0.0-3.0.5 Affected: 3.1.0-3.1.1 Affected: 5.0.0-RC1 Affected: 5.0.0-5.0.3 Affected: 6.0.0-RC1 Affected: 6.0.0-6.0.6 Affected: 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111438",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:22:00.742739Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:22:23.532Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS)",
"defaultStatus": "unaffected",
"platforms": [
"openEuler",
"Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
},
{
"status": "affected",
"version": "3.0.0-3.0.5"
},
{
"status": "affected",
"version": "3.1.0-3.1.1"
},
{
"status": "affected",
"version": "5.0.0-RC1"
},
{
"status": "affected",
"version": "5.0.0-5.0.3"
},
{
"status": "affected",
"version": "6.0.0-RC1"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
},
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u5728 openGauss-server \u7684 src/common/backend/libpq/hba.cpp \u4e2d\uff0c\u590d\u5236\u8fde\u63a5\u8ba4\u8bc1\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u7ed5\u8fc7\u3002hba_getauthmethod() \u5728\u5904\u7406 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u65f6\uff0c\u4e0d\u8981\u6c42 is_node_internal_connection()\uff0c\u76f4\u63a5\u8c03\u7528 check_hba_replication()\u3002check_hba_replication() \u4ec5\u6309 replication \u6807\u8bb0\u505a\u5f31\u5339\u914d\uff0c\u7f3a\u5c11\u666e\u901a check_hba() \u4e2d\u7684\u8fdc\u7a0b trust \u7981\u6b62\u7b49\u5b8c\u6574\u6821\u9a8c\u3002\u56e0\u6b64\uff0c\u975e\u5185\u90e8\u7f51\u7edc\u7684 HADR/SW \u590d\u5236\u8fde\u63a5\u53ef\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u9650\u5236\u548c\u5b8c\u6574 pg_hba \u7b56\u7565\u5b8c\u6210\u8ba4\u8bc1\uff0c\u8fdb\u800c\u901a\u8fc7\u590d\u5236\u534f\u8bae\u8bfb\u53d6\u5907\u4efd\u4e0e\u65e5\u5fd7\u6570\u636e\u3002\u003cbr\u003e\u003cbr\u003e\u6b64\u95ee\u9898\u968f HADR \u590d\u5236\u53d1\u9001\u65b9\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u6821\u9a8c\u8fdb\u5165\u4ee3\u7801\uff0c\u81ea 3.0.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 3.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS\u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u8981\u6c42 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u5fc5\u987b\u7ecf\u8fc7 is_node_internal_connection \u6821\u9a8c\uff0c\u4f7f\u5916\u90e8\u590d\u5236\u8fde\u63a5\u6539\u8d70\u666e\u901a check_hba() \u5e76\u89e6\u53d1\u7981\u6b62\u8fdc\u7a0b trust \u7b56\u7565\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-server/pull/9757\u3002\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "\u5728 openGauss-server \u7684 src/common/backend/libpq/hba.cpp \u4e2d\uff0c\u590d\u5236\u8fde\u63a5\u8ba4\u8bc1\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u7ed5\u8fc7\u3002hba_getauthmethod() \u5728\u5904\u7406 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u65f6\uff0c\u4e0d\u8981\u6c42 is_node_internal_connection()\uff0c\u76f4\u63a5\u8c03\u7528 check_hba_replication()\u3002check_hba_replication() \u4ec5\u6309 replication \u6807\u8bb0\u505a\u5f31\u5339\u914d\uff0c\u7f3a\u5c11\u666e\u901a check_hba() \u4e2d\u7684\u8fdc\u7a0b trust \u7981\u6b62\u7b49\u5b8c\u6574\u6821\u9a8c\u3002\u56e0\u6b64\uff0c\u975e\u5185\u90e8\u7f51\u7edc\u7684 HADR/SW \u590d\u5236\u8fde\u63a5\u53ef\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u9650\u5236\u548c\u5b8c\u6574 pg_hba \u7b56\u7565\u5b8c\u6210\u8ba4\u8bc1\uff0c\u8fdb\u800c\u901a\u8fc7\u590d\u5236\u534f\u8bae\u8bfb\u53d6\u5907\u4efd\u4e0e\u65e5\u5fd7\u6570\u636e\u3002\n\n\u6b64\u95ee\u9898\u968f HADR \u590d\u5236\u53d1\u9001\u65b9\u7ed5\u8fc7\u5185\u90e8\u8fde\u63a5\u6821\u9a8c\u8fdb\u5165\u4ee3\u7801\uff0c\u81ea 3.0.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 3.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS\u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u8981\u6c42 HADR/SW \u590d\u5236\u53d1\u9001\u65b9\u5fc5\u987b\u7ecf\u8fc7 is_node_internal_connection \u6821\u9a8c\uff0c\u4f7f\u5916\u90e8\u590d\u5236\u8fde\u63a5\u6539\u8d70\u666e\u901a check_hba() \u5e76\u89e6\u53d1\u7981\u6b62\u8fdc\u7a0b trust \u7b56\u7565\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-server/pull/9757\u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:08:03.265Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-server/pull/9757"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "check_hba_replication \u8ba4\u8bc1\u4e0e\u8bbf\u95ee\u63a7\u5236\u7ed5\u8fc7",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111438",
"datePublished": "2026-10-19T08:08:03.265Z",
"dateReserved": "2026-10-16T03:04:53.420Z",
"dateUpdated": "2026-10-19T17:22:23.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110852 (GCVE-0-2026-110852)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-15 13:42
VLAI
EPSS
VEX
Title
n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
Summary
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:42 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:42:31.527728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T13:42:40.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "1.123.83",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.41.4",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThan": "2.42.1",
"status": "affected",
"version": "2.42.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.123.83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.41.4",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.42.1",
"versionStartIncluding": "2.42.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "foxmiti"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL\u0027s only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects\u0027 credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:28.462Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4c7j-qff5-r9cx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-4c7j-qff5-r9cx"
},
{
"name": "VulnCheck Advisory: n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-unauthenticated-workflow-execution-via-dynamic-path-webhook-resolution"
}
],
"title": "n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110852",
"datePublished": "2026-10-14T22:52:28.462Z",
"dateReserved": "2026-10-14T22:16:22.734Z",
"dateUpdated": "2026-10-15T13:42:40.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110130 (GCVE-0-2026-110130)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:05 – Updated: 2026-10-14 16:31
VLAI
EPSS
VEX
Title
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Summary
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:31 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Finsys/dockhand/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/dockhand-bef… | third-party-advisory |
Impacted products
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110130",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:31:21.155720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:31:37.520Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Finsys/dockhand",
"product": "dockhand",
"repo": "https://github.com/Finsys/dockhand",
"vendor": "Finsys",
"versions": [
{
"lessThan": "1.0.45",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.0.45",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Allan Victor"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/\u003cid\u003e.js to reset the admin\u0027s or any user\u0027s password and take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:05:27.887Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-r3mg-r5vm-3v6w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w"
},
{
"name": "VulnCheck Advisory: Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.45-authentication-bypass-via-static-asset-check"
}
],
"title": "Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110130",
"datePublished": "2026-10-13T19:05:27.887Z",
"dateReserved": "2026-10-13T16:24:42.141Z",
"dateUpdated": "2026-10-14T16:31:37.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107656 (GCVE-0-2026-107656)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:45 – Updated: 2026-10-27 03:55
VLAI
EPSS
VEX
Summary
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 00:00 UTC
CWE
- CWE-288 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiSandbox |
Affected:
5.0.0 , ≤ 5.0.6
(semver)
Affected: 4.4.0 , ≤ 4.4.9 (semver) Affected: 4.2.1 , ≤ 4.2.8 (semver) cpe:2.3:a:fortinet:fortisandbox:5.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:* |
|
| Fortinet | FortiSandbox PaaS |
Affected:
5.0.0 , ≤ 5.0.6
(semver)
Affected: 4.4.0 , ≤ 4.4.9 (semver) Affected: 4.2.1 , ≤ 4.2.8 (semver) cpe:2.3:a:fortinet:fortisandboxpaas:5.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:4.2.1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107656",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T03:55:29.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandbox:5.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.6",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.9",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.8",
"status": "affected",
"version": "4.2.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:4.2.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox PaaS",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.6",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.9",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.8",
"status": "affected",
"version": "4.2.1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:45:03.962Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-185",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-185"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiSandbox version 5.2.0 or above\nUpgrade to FortiSandbox version 5.0.7 or above\nUpgrade to FortiSandbox version 4.4.10 or above\nUpgrade to FortiSandbox PaaS version 5.0.7 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2026-107656",
"datePublished": "2026-10-26T13:45:03.962Z",
"dateReserved": "2026-10-08T14:34:01.864Z",
"dateUpdated": "2026-10-27T03:55:29.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107361 (GCVE-0-2026-107361)
Vulnerability from cvelistv5 – Published: 2026-10-08 17:27 – Updated: 2026-10-14 19:41
VLAI
EPSS
VEX
Title
Authentication Bypass Using an Alternate Path or Channel in Malcolm
Summary
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.
Severity
4.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 19:08 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/cisagov/Malcolm/security/advis… | |
| https://github.com/cisagov/CSAF/blob/develop/csaf… | government-resource |
Impacted products
Date Public
2026-10-07 19:02
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107361",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T19:08:48.001107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:09:10.459Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-86h3-7rf8-8j34"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Malcolm",
"vendor": "CISA",
"versions": [
{
"lessThanOrEqual": "26.07.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "26.08.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Seth Grover"
},
{
"lang": "en",
"type": "finder",
"value": "Pavan Nallamothu"
}
],
"datePublic": "2026-10-07T19:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Arkime live capture service (\u003ccode\u003earkime-live\u003c/code\u003e) in Malcolm runs with \u003ccode\u003enetwork_mode: host\u003c/code\u003e, exposing port 8005 on all network interfaces (\u003ccode\u003eviewHost=0.0.0.0\u003c/code\u003e). Arkime trusts the \u003ccode\u003eX-Forwarded-User\u003c/code\u003e header from any IP address (\u003ccode\u003euserAuthIps=::,0.0.0.0/0\u003c/code\u003e) and auto-creates users with full access. The \u003ccode\u003epasswordSecret\u003c/code\u003e is hardcoded to the public value \u003ccode\u003e\"Malcolm\"\u003c/code\u003e. A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header."
}
],
"value": "The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value \"Malcolm\". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T19:41:55.715Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-86h3-7rf8-8j34"
},
{
"tags": [
"government-resource"
],
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version v26.08.0"
}
],
"value": "Update to version v26.08.0"
}
],
"source": {
"advisory": "ICSA-26-280-01",
"discovery": "INTERNAL"
},
"title": "Authentication Bypass Using an Alternate Path or Channel in Malcolm",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-107361",
"datePublished": "2026-10-08T17:27:03.689Z",
"dateReserved": "2026-10-07T20:08:34.511Z",
"dateUpdated": "2026-10-14T19:41:55.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107194 (GCVE-0-2026-107194)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:54 – Updated: 2026-10-19 14:03 Exclusively Hosted Service
VLAI
EPSS
VEX
Summary
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:23 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Sungrow | iSolarCloud |
Affected:
0 , < 2026-08-25
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107194",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:23:16.633923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:23:26.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-19T13:52:48.206Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.sungrowpower.com/en/login-bypass-vulnerability-in-sungrow-isolarcloud"
},
{
"url": "https://www.linkedin.com/posts/patrick-lamplmair-0aa66715b_otsecurity-gridsecurity-solarenergy-activity-7514199420771393536-HAi3"
},
{
"url": "https://www.pv-magazine.com/2026/10/08/sungrow-patches-isolarcloud-vulnerability-after-security-researchers-gain-access/"
},
{
"url": "https://www.pv-tech.org/sungrow-patches-cloud-vulnerability-affecting-solar-inverters/"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSolarCloud",
"vendor": "Sungrow",
"versions": [
{
"lessThan": "2026-08-25",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via \"login_type\":\"5\" in a login request, potentially leading to \"local blackouts on the whole continent\" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:03:48.206Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.sungrowpower.com/en/products/cloud-software/isolarcloud"
},
{
"url": "https://jakkaru.de/articles/sungrow-vulnerability-exposes-gigawatts-worldwide"
}
],
"tags": [
"exclusively-hosted-service"
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-107194",
"datePublished": "2026-10-07T13:54:45.211Z",
"dateReserved": "2026-10-07T13:54:44.767Z",
"dateUpdated": "2026-10-19T14:03:48.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106602 (GCVE-0-2026-106602)
Vulnerability from cvelistv5 – Published: 2026-10-09 12:08 – Updated: 2026-10-11 12:13 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:03 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack |
Affected:
0 , ≤ 16.2
(custom)
|
Date Public
2026-10-07 11:21
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:03:22.572080Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:41.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "jetpack",
"product": "Jetpack",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "16.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "16.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-07T11:21:22.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.\u003cp\u003eThis issue affects Jetpack: from n/a through 16.2.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T12:08:38.768Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Jetpack plugin \u003c= 16.2 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-106602",
"datePublished": "2026-10-09T12:08:38.768Z",
"dateReserved": "2026-10-07T00:21:31.996Z",
"dateUpdated": "2026-10-11T12:13:41.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.