Common Weakness Enumeration
CWE-488
AllowedExposure of Data Element to Wrong Session
Abstraction: Base · Status: Draft
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
72 vulnerabilities reference this CWE, most recent first.
CVE-2026-23919 (GCVE-0-2026-23919)
Vulnerability from cvelistv5 – Published: 2026-03-24 18:26 – Updated: 2026-04-22 07:06
VLAI
EPSS
VEX
Title
Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
Summary
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-24 18:36 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23919",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T18:36:08.999862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T18:36:16.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"Server",
"Proxy"
],
"product": "Zabbix",
"repo": "https://git.zabbix.com/",
"vendor": "Zabbix",
"versions": [
{
"changes": [
{
"at": "6.0.42",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.41",
"status": "affected",
"version": "6.0.0",
"versionType": "git"
},
{
"changes": [
{
"at": "7.0.19",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.18",
"status": "affected",
"version": "7.0.0",
"versionType": "git"
},
{
"changes": [
{
"at": "7.2.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.2.12",
"status": "affected",
"version": "7.2.0",
"versionType": "git"
},
{
"changes": [
{
"at": "7.4.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.4.2",
"status": "affected",
"version": "7.4.0",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA regular Zabbix administrator (non-super) can overwrite some built in JavaScript functions that are then executed for other objects. Alternatively, a regular Zabbix administrator can read global JavaScript variables.\u003c/p\u003e"
}
],
"value": "A regular Zabbix administrator (non-super) can overwrite some built in JavaScript functions that are then executed for other objects. Alternatively, a regular Zabbix administrator can read global JavaScript variables."
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zabbix wants to thank Yerdan (big_john) for submitting this report on the HackerOne bug bounty platform."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFor performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information \u0026lt;a href=\u0027https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe\u0027\u0026gt;in Zabbix documentation\u0026lt;/a\u0026gt;.\u003c/p\u003e"
}
],
"value": "For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information \u003ca href=\u0027https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe\u0027\u003ein Zabbix documentation\u003c/a\u003e."
}
],
"impacts": [
{
"capecId": "CAPEC-124",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-124: Shared Resource Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T07:06:32.148Z",
"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
"shortName": "Zabbix"
},
"references": [
{
"url": "https://support.zabbix.com/browse/ZBX-27638"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate the affected components to their respective fixed versions. Make sure JavaScript item preprocessing scripts don\u0027t store secret data in global variables.\u003c/p\u003e"
}
],
"value": "Update the affected components to their respective fixed versions. Make sure JavaScript item preprocessing scripts don\u0027t store secret data in global variables."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
"assignerShortName": "Zabbix",
"cveId": "CVE-2026-23919",
"datePublished": "2026-03-24T18:26:43.877Z",
"dateReserved": "2026-01-19T14:02:54.327Z",
"dateUpdated": "2026-04-22T07:06:32.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23844 (GCVE-0-2026-23844)
Vulnerability from cvelistv5 – Published: 2026-01-19 20:43 – Updated: 2026-01-20 15:54
VLAI
EPSS
VEX
Title
Whisper Money has IDOR Vulnerability on sync/balances endpoint
Summary
Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-20 15:53 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/whisper-money/whisper-money/se… | x_refsource_CONFIRM |
| https://github.com/whisper-money/whisper-money/pull/60 | x_refsource_MISC |
| https://github.com/whisper-money/whisper-money/co… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| whisper-money | whisper-money |
Affected:
< 0.1.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23844",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-20T15:53:46.959807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T15:54:02.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "whisper-money",
"vendor": "whisper-money",
"versions": [
{
"status": "affected",
"version": "\u003c 0.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users\u0027 bank accounts. Version 0.1.5 fixes the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-19T20:43:29.212Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/whisper-money/whisper-money/security/advisories/GHSA-c4g3-wpxr-2m74",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/whisper-money/whisper-money/security/advisories/GHSA-c4g3-wpxr-2m74"
},
{
"name": "https://github.com/whisper-money/whisper-money/pull/60",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/whisper-money/whisper-money/pull/60"
},
{
"name": "https://github.com/whisper-money/whisper-money/commit/80117c3edeaf5c5a5166f3815fc555a15b5ce686",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/whisper-money/whisper-money/commit/80117c3edeaf5c5a5166f3815fc555a15b5ce686"
}
],
"source": {
"advisory": "GHSA-c4g3-wpxr-2m74",
"discovery": "UNKNOWN"
},
"title": "Whisper Money has IDOR Vulnerability on sync/balances endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23844",
"datePublished": "2026-01-19T20:43:29.212Z",
"dateReserved": "2026-01-16T15:46:40.842Z",
"dateUpdated": "2026-01-20T15:54:02.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23646 (GCVE-0-2026-23646)
Vulnerability from cvelistv5 – Published: 2026-01-19 17:48 – Updated: 2026-01-20 14:54
VLAI
EPSS
VEX
Title
OpenProject users can delete other user's session, causing them to be logged out
Summary
OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-20 14:54 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opf/openproject/security/advis… | x_refsource_CONFIRM |
| https://github.com/opf/openproject/releases/tag/v16.6.5 | x_refsource_MISC |
| https://github.com/opf/openproject/releases/tag/v17.0.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| opf | openproject |
Affected:
< 16.6.5
Affected: = 17.0.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23646",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-20T14:54:33.443866Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T14:54:40.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openproject",
"vendor": "opf",
"versions": [
{
"status": "affected",
"version": "\u003c 16.6.5"
},
{
"status": "affected",
"version": "= 17.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings \u2192 Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-19T17:48:03.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp"
},
{
"name": "https://github.com/opf/openproject/releases/tag/v16.6.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opf/openproject/releases/tag/v16.6.5"
},
{
"name": "https://github.com/opf/openproject/releases/tag/v17.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opf/openproject/releases/tag/v17.0.1"
}
],
"source": {
"advisory": "GHSA-w422-xf8f-v4vp",
"discovery": "UNKNOWN"
},
"title": "OpenProject users can delete other user\u0027s session, causing them to be logged out"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23646",
"datePublished": "2026-01-19T17:48:03.082Z",
"dateReserved": "2026-01-14T16:08:37.484Z",
"dateUpdated": "2026-01-20T14:54:40.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19931 (GCVE-0-2026-19931)
Vulnerability from cvelistv5 – Published: 2026-09-06 17:47 – Updated: 2026-09-15 06:02
VLAI
EPSS
VEX
Title
Negotiate ambient user conn reuse
Summary
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
hostname using Negotiate authentication, when the initial request is done
using empty credentials. This can make user B's request get sent over user A's
previously authenticated connection.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 15:42 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl |
Affected:
7.64.1 , < 8.14.2
(semver)
Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) Affected: 8.21.0 , < 8.22.0 (semver) |
|
| curl | curl |
Affected:
6c6035532383e300c712e4c1cd9fdd749ed5cf59 , < 7103a93b05bc69ea98ed9d05d02fa9eeba533f2f
(git)
|
|
| curl | curl |
Affected:
8.21.0
Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-19931",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T15:42:15.881334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488 Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T15:42:43.125Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackerone.com/reports/3923520"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThan": "8.14.2",
"status": "affected",
"version": "7.64.1",
"versionType": "semver"
},
{
"lessThan": "8.16.1",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThan": "8.20.1",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
},
{
"lessThan": "8.22.0",
"status": "affected",
"version": "8.21.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"versions": [
{
"lessThan": "7103a93b05bc69ea98ed9d05d02fa9eeba533f2f",
"status": "affected",
"version": "6c6035532383e300c712e4c1cd9fdd749ed5cf59",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"status": "affected",
"version": "8.21.0"
},
{
"status": "affected",
"version": "8.20.0"
},
{
"status": "affected",
"version": "8.19.0"
},
{
"status": "affected",
"version": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0"
},
{
"status": "affected",
"version": "8.11.1"
},
{
"status": "affected",
"version": "8.11.0"
},
{
"status": "affected",
"version": "8.10.1"
},
{
"status": "affected",
"version": "8.10.0"
},
{
"status": "affected",
"version": "8.9.1"
},
{
"status": "affected",
"version": "8.9.0"
},
{
"status": "affected",
"version": "8.8.0"
},
{
"status": "affected",
"version": "8.7.1"
},
{
"status": "affected",
"version": "8.7.0"
},
{
"status": "affected",
"version": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0"
},
{
"status": "affected",
"version": "8.4.0"
},
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.2.1"
},
{
"status": "affected",
"version": "8.2.0"
},
{
"status": "affected",
"version": "8.1.2"
},
{
"status": "affected",
"version": "8.1.1"
},
{
"status": "affected",
"version": "8.1.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "7.88.1"
},
{
"status": "affected",
"version": "7.88.0"
},
{
"status": "affected",
"version": "7.87.0"
},
{
"status": "affected",
"version": "7.86.0"
},
{
"status": "affected",
"version": "7.85.0"
},
{
"status": "affected",
"version": "7.84.0"
},
{
"status": "affected",
"version": "7.83.1"
},
{
"status": "affected",
"version": "7.83.0"
},
{
"status": "affected",
"version": "7.82.0"
},
{
"status": "affected",
"version": "7.81.0"
},
{
"status": "affected",
"version": "7.80.0"
},
{
"status": "affected",
"version": "7.79.1"
},
{
"status": "affected",
"version": "7.79.0"
},
{
"status": "affected",
"version": "7.78.0"
},
{
"status": "affected",
"version": "7.77.0"
},
{
"status": "affected",
"version": "7.76.1"
},
{
"status": "affected",
"version": "7.76.0"
},
{
"status": "affected",
"version": "7.75.0"
},
{
"status": "affected",
"version": "7.74.0"
},
{
"status": "affected",
"version": "7.73.0"
},
{
"status": "affected",
"version": "7.72.0"
},
{
"status": "affected",
"version": "7.71.1"
},
{
"status": "affected",
"version": "7.71.0"
},
{
"status": "affected",
"version": "7.70.0"
},
{
"status": "affected",
"version": "7.69.1"
},
{
"status": "affected",
"version": "7.69.0"
},
{
"status": "affected",
"version": "7.68.0"
},
{
"status": "affected",
"version": "7.67.0"
},
{
"status": "affected",
"version": "7.66.0"
},
{
"status": "affected",
"version": "7.65.3"
},
{
"status": "affected",
"version": "7.65.2"
},
{
"status": "affected",
"version": "7.65.1"
},
{
"status": "affected",
"version": "7.65.0"
},
{
"status": "affected",
"version": "7.64.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Dukek"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Stefan Eissing"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0027s request get sent over user A\u0027s\npreviously authenticated connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T06:02:51.009Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"url": "https://curl.se/docs/CVE-2026-19931.json"
},
{
"url": "https://curl.se/docs/CVE-2026-19931.html"
},
{
"url": "https://hackerone.com/reports/3923520"
}
],
"title": "Negotiate ambient user conn reuse",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_osv": {
"affected": [
{
"ranges": [
{
"events": [
{
"introduced": "7.64.1"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.1"
},
{
"introduced": "8.21.0"
},
{
"fixed": "8.22.0"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "6c6035532383e300c712e4c1cd9fdd749ed5cf59"
},
{
"fixed": "7103a93b05bc69ea98ed9d05d02fa9eeba533f2f"
}
],
"repo": "https://github.com/curl/curl.git",
"type": "GIT"
}
],
"versions": [
"8.21.0",
"8.20.0",
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1"
]
}
],
"aliases": [
"CVE-2026-19931"
],
"credits": [
{
"name": "Martin Dukek",
"type": "finder"
},
{
"name": "Stefan Eissing",
"type": "remediation developer"
}
],
"database_specific": {
"CWE": {
"desc": "Exposure of Data Element to Wrong Session",
"id": "CWE-488"
},
"URL": "https://curl.se/docs/CVE-2026-19931.json",
"affects": "both",
"issue": "https://hackerone.com/reports/3923520",
"last_affected": "8.21.0",
"package": "curl",
"severity": "Medium",
"www": "https://curl.se/docs/CVE-2026-19931.html"
},
"details": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0027s request get sent over user A\u0027s\npreviously authenticated connection.",
"id": "CURL-CVE-2026-19931",
"modified": "2026-09-07T10:34:51.00Z",
"published": "2026-09-02T08:00:00.00Z",
"schema_version": "1.5.0",
"summary": "Negotiate ambient user conn reuse"
}
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-19931",
"datePublished": "2026-09-06T17:47:43.523Z",
"dateReserved": "2026-08-15T10:35:02.789Z",
"dateUpdated": "2026-09-15T06:02:51.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18489 (GCVE-0-2026-18489)
Vulnerability from cvelistv5 – Published: 2026-09-04 16:23 – Updated: 2026-09-04 17:29
VLAI
EPSS
VEX
Title
IBM ContextForge Translate is affected by cross-client credential context confusion
Summary
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:29 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7286056 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | ContextForge MCP Gateway - Translate utility |
Affected:
<= 1.0.8
cpe:2.3:a:ibm:contextforge_mcp_gateway_translate_utility:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18489",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:29:48.993058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:29:57.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:contextforge_mcp_gateway_translate_utility:*:*:*:*:*:*:*:*"
],
"product": "ContextForge MCP Gateway - Translate utility",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM ContextForge MCP Gateway - Translate utility \u0026lt;= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.\u003c/p\u003e"
}
],
"value": "IBM ContextForge MCP Gateway - Translate utility \u003c= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488 Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:23:08.905Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7286056"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eIBM strongly recommends addressing the vulnerability now.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eThe IBM ContextForge Translate service is intended **only for local, single-session development use**. It does not provide the session isolation required for production or multi-client deployments. Users must ensure the Translate service is not exposed in any production capacity.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003ePR [#6388](\u003ca href=\"https://github.com/IBM/mcp-context-forge/pull/6388%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/pull/6388)\u003c/a\u003e (merged 2026-08-24) updates the product documentation to make this restriction explicit, removing previous guidance that could have implied multi-tenant production suitability.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now.\n\n\nThe IBM ContextForge Translate service is intended **only for local, single-session development use**. It does not provide the session isolation required for production or multi-client deployments. Users must ensure the Translate service is not exposed in any production capacity.\n\n\nPR [#6388]( https://github.com/IBM/mcp-context-forge/pull/6388) https://github.com/IBM/mcp-context-forge/pull/6388%29 (merged 2026-08-24) updates the product documentation to make this restriction explicit, removing previous guidance that could have implied multi-tenant production suitability."
}
],
"title": "IBM ContextForge Translate is affected by cross-client credential context confusion",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eDo not use the IBM ContextForge Translate service in any production or multi-client environment. The service is designed exclusively for local development scenarios where only a single client session is expected. This applies regardless of whether `--enable-dynamic-env` is active.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eIf the Translate service is currently running in a non-development environment:\u003c/div\u003e\u003cdiv\u003e1. Stop the Translate service and remove it from any production deployment immediately.\u003c/div\u003e\u003cdiv\u003e2. Rotate any credentials (API tokens, `Authorization` headers) that may have been mapped into the shared subprocess environment while multiple clients were connected.\u003c/div\u003e\u003cdiv\u003e3. Review audit logs for tool calls where the HTTP caller identity may not match the subprocess credential context.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Do not use the IBM ContextForge Translate service in any production or multi-client environment. The service is designed exclusively for local development scenarios where only a single client session is expected. This applies regardless of whether `--enable-dynamic-env` is active.\n\n\nIf the Translate service is currently running in a non-development environment:\n\n1. Stop the Translate service and remove it from any production deployment immediately.\n\n2. Rotate any credentials (API tokens, `Authorization` headers) that may have been mapped into the shared subprocess environment while multiple clients were connected.\n\n3. Review audit logs for tool calls where the HTTP caller identity may not match the subprocess credential context."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-18489",
"datePublished": "2026-09-04T16:23:08.905Z",
"dateReserved": "2026-07-31T13:49:30.524Z",
"dateUpdated": "2026-09-04T17:29:57.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16498 (GCVE-0-2026-16498)
Vulnerability from cvelistv5 – Published: 2026-07-28 17:57 – Updated: 2026-07-28 18:39
VLAI
EPSS
VEX
Title
terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Summary
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 18:38 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16498",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T18:38:22.534995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T18:39:15.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Tooling",
"repo": "https://github.com/hashicorp/terraform-mcp-server",
"vendor": "HashiCorp",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was identified by an internal team."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user\u0027s Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.\u003c/p\u003e\u003cbr/\u003e"
}
],
"value": "The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user\u0027s Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60: Reusing Session IDs (Session Replay)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T17:57:45.748Z",
"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"shortName": "HashiCorp"
},
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606"
}
],
"source": {
"advisory": "HCSEC-2026-23",
"discovery": "INTERNAL"
},
"title": "terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode"
}
},
"cveMetadata": {
"assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"assignerShortName": "HashiCorp",
"cveId": "CVE-2026-16498",
"datePublished": "2026-07-28T17:57:45.748Z",
"dateReserved": "2026-07-21T17:19:22.057Z",
"dateUpdated": "2026-07-28T18:39:15.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16326 (GCVE-0-2026-16326)
Vulnerability from cvelistv5 – Published: 2026-07-29 18:40 – Updated: 2026-07-29 19:10
VLAI
EPSS
VEX
Title
consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Summary
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 19:10 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T19:10:01.220224Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T19:10:11.027Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Tooling",
"repo": "https://github.com/hashicorp/consul-mcp-server",
"vendor": "HashiCorp",
"versions": [
{
"lessThan": "0.1.4",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported by an internal HashiCorp team."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client\u0027s Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.\u003c/p\u003e\u003cbr/\u003e"
}
],
"value": "In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client\u0027s Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60: Reusing Session IDs (Session Replay)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:40:08.796Z",
"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"shortName": "HashiCorp"
},
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612"
}
],
"source": {
"advisory": "HCSEC-2026-24",
"discovery": "INTERNAL"
},
"title": "consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode"
}
},
"cveMetadata": {
"assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"assignerShortName": "HashiCorp",
"cveId": "CVE-2026-16326",
"datePublished": "2026-07-29T18:40:08.796Z",
"dateReserved": "2026-07-20T17:50:16.465Z",
"dateUpdated": "2026-07-29T19:10:11.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14621 (GCVE-0-2026-14621)
Vulnerability from cvelistv5 – Published: 2026-07-04 08:15 – Updated: 2026-07-06 16:51
VLAI
EPSS
VEX
Title
FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session
Summary
A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-06 16:36 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/376137 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/376137/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-14621 | third-party-advisory |
| https://vuldb.com/submit/844900 | third-party-advisory |
| https://github.com/FederatedAI/FATE/issues/5791 | exploitissue-tracking |
| https://github.com/FederatedAI/FATE/pull/5792 | issue-trackingpatch |
| https://github.com/FederatedAI/FATE/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FederatedAI | FATE |
Affected:
2.0
Affected: 2.1 Affected: 2.2.0 cpe:2.3:a:federatedai:fate:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14621",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T16:36:21.395762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T16:51:38.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:federatedai:fate:*:*:*:*:*:*:*:*"
],
"modules": [
"OSX Broker"
],
"product": "FATE",
"vendor": "FederatedAI",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem00000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T08:15:08.912Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-376137 | FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/376137"
},
{
"name": "VDB-376137 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/376137/cti"
},
{
"name": "CVE-2026-14621 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-14621"
},
{
"name": "Submit #844900 | FederatedAI FATE (OSX Broker) 5a06d9e4c4cd7ab97a5c8357828adbffaca87785 Improper Isolation / Cross-Tenant Data Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/844900"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/FederatedAI/FATE/issues/5791"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/FederatedAI/FATE/pull/5792"
},
{
"tags": [
"product"
],
"url": "https://github.com/FederatedAI/FATE/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-03T18:57:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-14621",
"datePublished": "2026-07-04T08:15:08.912Z",
"dateReserved": "2026-07-03T16:52:34.586Z",
"dateUpdated": "2026-07-06T16:51:38.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9831 (GCVE-0-2026-9831)
Vulnerability from cvelistv5 – Published: 2026-05-29 21:19 – Updated: 2026-06-01 13:53
VLAI
EPSS
VEX
Title
ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition
Summary
A race condition in the shared Extreme Platform
ONE IAM Gateway API-key authentication path could, under specific
high-concurrency traffic conditions, intermittently allow requests
authenticated with an Extreme Platform ONE /IAM-issued API key to receive
response data for another tenant. The issue was observed through ExtremeCloud
IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE
/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT
authentication were not affected.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 13:52 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.extremenetworks.com/t5/security… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Extreme Networks | Extreme Platform ONE |
Affected:
0 , < 25.10.0-104
(custom)
Unaffected: 25.10.0-104 (custom) |
Date Public
2026-05-29 21:09
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T13:52:52.575235Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T13:53:05.140Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"SaaS (Cloud Hosted)"
],
"product": "Extreme Platform ONE",
"vendor": "Extreme Networks",
"versions": [
{
"lessThan": "25.10.0-104",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "25.10.0-104",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible discovery and disclosure of this vulnerability."
},
{
"lang": "en",
"type": "reporter",
"value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible coordination and providing detailed evidence supporting root cause identification."
}
],
"datePublic": "2026-05-29T21:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."
}
],
"value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."
}
],
"impacts": [
{
"capecId": "CAPEC-74",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-74: Manipulating State"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488 Exposure of data element to wrong session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T21:19:17.118Z",
"orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
"shortName": "ExtremeNetworks"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851"
}
],
"source": {
"advisory": "SA-2026-048",
"discovery": "EXTERNAL"
},
"title": "ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
"assignerShortName": "ExtremeNetworks",
"cveId": "CVE-2026-9831",
"datePublished": "2026-05-29T21:19:17.118Z",
"dateReserved": "2026-05-28T12:21:45.520Z",
"dateUpdated": "2026-06-01T13:53:05.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8458 (GCVE-0-2026-8458)
Vulnerability from cvelistv5 – Published: 2026-07-03 06:14 – Updated: 2026-09-15 06:03
VLAI
EPSS
VEX
Title
wrong reuse for different services
Summary
libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
"services".
libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different services.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-06 17:31 UTC
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl |
Affected:
7.43.0 , < 8.14.2
(semver)
Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) |
|
| curl | curl |
Affected:
97c272e5d173ad5f706443e2477f0a84f0044edd , < 5e99b73cf441d9c369768b9cd48b5389b9a2503d
(git)
|
|
| curl | curl |
Affected:
8.20.0
Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-8458",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T17:31:14.007899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T17:32:06.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackerone.com/reports/3721183"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThan": "8.14.2",
"status": "affected",
"version": "7.43.0",
"versionType": "semver"
},
{
"lessThan": "8.16.1",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThan": "8.20.1",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"versions": [
{
"lessThan": "5e99b73cf441d9c369768b9cd48b5389b9a2503d",
"status": "affected",
"version": "97c272e5d173ad5f706443e2477f0a84f0044edd",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"status": "affected",
"version": "8.20.0"
},
{
"status": "affected",
"version": "8.19.0"
},
{
"status": "affected",
"version": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0"
},
{
"status": "affected",
"version": "8.11.1"
},
{
"status": "affected",
"version": "8.11.0"
},
{
"status": "affected",
"version": "8.10.1"
},
{
"status": "affected",
"version": "8.10.0"
},
{
"status": "affected",
"version": "8.9.1"
},
{
"status": "affected",
"version": "8.9.0"
},
{
"status": "affected",
"version": "8.8.0"
},
{
"status": "affected",
"version": "8.7.1"
},
{
"status": "affected",
"version": "8.7.0"
},
{
"status": "affected",
"version": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0"
},
{
"status": "affected",
"version": "8.4.0"
},
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.2.1"
},
{
"status": "affected",
"version": "8.2.0"
},
{
"status": "affected",
"version": "8.1.2"
},
{
"status": "affected",
"version": "8.1.1"
},
{
"status": "affected",
"version": "8.1.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "7.88.1"
},
{
"status": "affected",
"version": "7.88.0"
},
{
"status": "affected",
"version": "7.87.0"
},
{
"status": "affected",
"version": "7.86.0"
},
{
"status": "affected",
"version": "7.85.0"
},
{
"status": "affected",
"version": "7.84.0"
},
{
"status": "affected",
"version": "7.83.1"
},
{
"status": "affected",
"version": "7.83.0"
},
{
"status": "affected",
"version": "7.82.0"
},
{
"status": "affected",
"version": "7.81.0"
},
{
"status": "affected",
"version": "7.80.0"
},
{
"status": "affected",
"version": "7.79.1"
},
{
"status": "affected",
"version": "7.79.0"
},
{
"status": "affected",
"version": "7.78.0"
},
{
"status": "affected",
"version": "7.77.0"
},
{
"status": "affected",
"version": "7.76.1"
},
{
"status": "affected",
"version": "7.76.0"
},
{
"status": "affected",
"version": "7.75.0"
},
{
"status": "affected",
"version": "7.74.0"
},
{
"status": "affected",
"version": "7.73.0"
},
{
"status": "affected",
"version": "7.72.0"
},
{
"status": "affected",
"version": "7.71.1"
},
{
"status": "affected",
"version": "7.71.0"
},
{
"status": "affected",
"version": "7.70.0"
},
{
"status": "affected",
"version": "7.69.1"
},
{
"status": "affected",
"version": "7.69.0"
},
{
"status": "affected",
"version": "7.68.0"
},
{
"status": "affected",
"version": "7.67.0"
},
{
"status": "affected",
"version": "7.66.0"
},
{
"status": "affected",
"version": "7.65.3"
},
{
"status": "affected",
"version": "7.65.2"
},
{
"status": "affected",
"version": "7.65.1"
},
{
"status": "affected",
"version": "7.65.0"
},
{
"status": "affected",
"version": "7.64.1"
},
{
"status": "affected",
"version": "7.64.0"
},
{
"status": "affected",
"version": "7.63.0"
},
{
"status": "affected",
"version": "7.62.0"
},
{
"status": "affected",
"version": "7.61.1"
},
{
"status": "affected",
"version": "7.61.0"
},
{
"status": "affected",
"version": "7.60.0"
},
{
"status": "affected",
"version": "7.59.0"
},
{
"status": "affected",
"version": "7.58.0"
},
{
"status": "affected",
"version": "7.57.0"
},
{
"status": "affected",
"version": "7.56.1"
},
{
"status": "affected",
"version": "7.56.0"
},
{
"status": "affected",
"version": "7.55.1"
},
{
"status": "affected",
"version": "7.55.0"
},
{
"status": "affected",
"version": "7.54.1"
},
{
"status": "affected",
"version": "7.54.0"
},
{
"status": "affected",
"version": "7.53.1"
},
{
"status": "affected",
"version": "7.53.0"
},
{
"status": "affected",
"version": "7.52.1"
},
{
"status": "affected",
"version": "7.52.0"
},
{
"status": "affected",
"version": "7.51.0"
},
{
"status": "affected",
"version": "7.50.3"
},
{
"status": "affected",
"version": "7.50.2"
},
{
"status": "affected",
"version": "7.50.1"
},
{
"status": "affected",
"version": "7.50.0"
},
{
"status": "affected",
"version": "7.49.1"
},
{
"status": "affected",
"version": "7.49.0"
},
{
"status": "affected",
"version": "7.48.0"
},
{
"status": "affected",
"version": "7.47.1"
},
{
"status": "affected",
"version": "7.47.0"
},
{
"status": "affected",
"version": "7.46.0"
},
{
"status": "affected",
"version": "7.45.0"
},
{
"status": "affected",
"version": "7.44.0"
},
{
"status": "affected",
"version": "7.43.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhamad Arga Reksapati"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Stefan Eissing"
}
],
"descriptions": [
{
"lang": "en",
"value": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T06:03:19.330Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"url": "https://curl.se/docs/CVE-2026-8458.json"
},
{
"url": "https://curl.se/docs/CVE-2026-8458.html"
},
{
"url": "https://hackerone.com/reports/3721183"
}
],
"title": "wrong reuse for different services",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_osv": {
"affected": [
{
"ranges": [
{
"events": [
{
"introduced": "7.43.0"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.1"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "97c272e5d173ad5f706443e2477f0a84f0044edd"
},
{
"fixed": "5e99b73cf441d9c369768b9cd48b5389b9a2503d"
}
],
"repo": "https://github.com/curl/curl.git",
"type": "GIT"
}
],
"versions": [
"8.20.0",
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0"
]
}
],
"aliases": [
"CVE-2026-8458"
],
"credits": [
{
"name": "Muhamad Arga Reksapati",
"type": "finder"
},
{
"name": "Stefan Eissing",
"type": "remediation developer"
}
],
"database_specific": {
"CWE": {
"desc": "Exposure of Data Element to Wrong Session",
"id": "CWE-488"
},
"URL": "https://curl.se/docs/CVE-2026-8458.json",
"affects": "both",
"issue": "https://hackerone.com/reports/3721183",
"last_affected": "8.20.0",
"package": "curl",
"severity": "Low",
"www": "https://curl.se/docs/CVE-2026-8458.html"
},
"details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.",
"id": "CURL-CVE-2026-8458",
"modified": "2026-09-07T10:34:51.00Z",
"published": "2026-06-24T08:00:00.00Z",
"schema_version": "1.5.0",
"summary": "wrong reuse for different services"
}
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-8458",
"datePublished": "2026-07-03T06:14:42.258Z",
"dateReserved": "2026-05-13T08:33:36.632Z",
"dateUpdated": "2026-09-15T06:03:19.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
Mitigation
Testing
Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
Mitigation
Architecture and Design
In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.