CWE-863

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:42.610Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/85ef1da670cee132ea2d8e4eb759bab310ff73c9"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L2544"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-command-execution-via-remote-query"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129125",
    "datePublished": "2026-11-13T16:23:42.610Z",
    "dateReserved": "2026-11-13T16:01:01.509Z",
    "dateUpdated": "2026-11-13T16:23:42.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "11.0.506",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:45.983Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/49e04a5ccfa08706b1d7e51dce4059f4adce50f3"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L3452"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-11.0.506-before-11.1.515-receive-confirm-bypass-via-recursive-get"
        }
      ],
      "title": "C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129120",
    "datePublished": "2026-11-13T16:23:45.983Z",
    "dateReserved": "2026-11-13T16:00:59.683Z",
    "dateUpdated": "2026-11-13T16:23:45.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129119",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:11:59.470857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:12:21.062Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:46.712Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfn3.c#L1798-L1800"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-file-collision-protection-bypass-via-resend"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129119",
    "datePublished": "2026-11-13T16:23:46.712Z",
    "dateReserved": "2026-11-13T16:00:59.324Z",
    "dateUpdated": "2026-11-13T21:12:21.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Eclipse BaSyx Go Components",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThan": "1.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Koort"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\u003c/p\u003e\u003cp\u003eAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\u003c/p\u003e\u003cp\u003eThe issue is fixed in Eclipse BaSyx Go Components v1.1.4.\u003c/p\u003e"
            }
          ],
          "value": "In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-64",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-64"
            }
          ]
        },
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-177",
              "description": "CWE-177",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:27:04.197Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1389"
        },
        {
          "url": "https://github.com/eclipse-basyx/basyx-go-components/pull/888"
        },
        {
          "url": "https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.4"
        },
        {
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/582"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2026-128986",
    "datePublished": "2026-11-13T16:27:04.197Z",
    "dateReserved": "2026-11-13T14:06:21.240Z",
    "dateUpdated": "2026-11-13T16:27:04.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-128970",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T19:53:45.836995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T20:05:03.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Psono Server Community Edition"
          ],
          "product": "Psono",
          "programFiles": [
            "psono/restapi/serializers/delete_share_right.py"
          ],
          "repo": "https://gitlab.com/esaqa/psono/psono-server",
          "vendor": "esaqa GmbH",
          "versions": [
            {
              "lessThan": "7.5.1",
              "status": "affected",
              "version": "1.12.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Psono Server Enterprise Edition"
          ],
          "product": "Psono",
          "vendor": "esaqa GmbH",
          "versions": [
            {
              "lessThan": "7.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nicholas Mullenski / K70n0s510"
        }
      ],
      "datePublic": "2026-11-13T14:22:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePsono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group\u0027s share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group\u0027s access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13.\u003c/p\u003e"
            }
          ],
          "value": "Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group\u0027s share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group\u0027s access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An authenticated user with a pending or declined group invitation carrying share_admin=True can delete the group\u0027s share-right records, revoking that group\u0027s access to the affected shares and their contained secrets for all accepted group members. The underlying shares and secrets are not deleted, and secret contents are not disclosed."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Authenticated user with a pending or declined group invitation carrying share_admin=True and knowledge of a target group share-right UUID. Unauthorized deletion modifies access-control records and removes the group\u0027s access to affected shared data."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T14:25:45.811Z",
        "orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
        "shortName": "esaqa"
      },
      "references": [
        {
          "name": "Vendor fix",
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/86e7ce7fdbb04fc4ae3430cc434179630948d48d"
        },
        {
          "name": "Psono 7.5.1 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.5.1"
        },
        {
          "name": "Vendor security advisory for CVE-2026-128970",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-128970.md"
        },
        {
          "name": "Affected Community Edition deletion authorization in Psono 7.5.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/serializers/delete_share_right.py"
        },
        {
          "name": "Community Edition create-path acceptance check in Psono 7.5.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/serializers/create_share_right.py"
        },
        {
          "name": "Community Edition membership decline behavior in Psono 7.5.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/views/membership_decline.py"
        },
        {
          "name": "Introduction of the Community Edition invite-only deletion authorization path",
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/11f9aa69dae370cd4f0213f4d03d1b1cc4df36dd"
        },
        {
          "name": "Psono Server Community Edition source repository",
          "tags": [
            "product"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade Psono Server Community Edition and Psono Server Enterprise Edition to version 7.5.1 or later. Version 7.5.1 was released for both editions on 2026-10-13. The patch adds accepted=True to the User_Group_Membership authorization query in DeleteShareRightSerializer.validate, making group share-right deletion require both accepted membership and share_admin=True, matching the group authorization check in the create path.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade Psono Server Community Edition and Psono Server Enterprise Edition to version 7.5.1 or later. Version 7.5.1 was released for both editions on 2026-10-13. The patch adds accepted=True to the User_Group_Membership authorization query in DeleteShareRightSerializer.validate, making group share-right deletion require both accepted membership and share_admin=True, matching the group authorization check in the create path."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T19:45:00.000Z",
          "value": "Vulnerability reported to esaqa GmbH by Nicholas Mullenski / K70n0s510 (2026-10-12 21:45 CEST, UTC+02:00)"
        },
        {
          "lang": "en",
          "time": "2026-10-13T05:18:00.000Z",
          "value": "Vendor fix implemented in commit 86e7ce7fdbb04fc4ae3430cc434179630948d48d, included in version 7.5.1 of both editions."
        }
      ],
      "title": "Missing membership acceptance check permits group share-right deletion by invitees in Psono Server",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUntil the patch is deployed, use authorized group administration to remove pending and declined group memberships carrying share-admin privileges, or clear their share_admin flag. Avoid granting share-admin privileges to unaccepted invitees on affected versions.\u003c/p\u003e"
            }
          ],
          "value": "Until the patch is deployed, use authorized group administration to remove pending and declined group memberships carrying share-admin privileges, or clear their share_admin flag. Avoid granting share-admin privileges to unaccepted invitees on affected versions."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      },
      "x_internal": {
        "note": "The organization/user UUIDs are placeholders. The PUBLISHED state selects the full-record schema and does not indicate actual publication. Replace placeholders and remove this internal note before submission. Version 7.5.1 was released for both Community Edition and Enterprise Edition on 2026-10-13 and includes fix commit 86e7ce7fdbb04fc4ae3430cc434179630948d48d, verified in both local repositories. The first Community Edition release containing the invite-only deletion authorization path is 1.12.6; release 1.12.5 still required independent grant rights on the share. Enterprise Edition is closed source; no Enterprise Edition source repository links are included. Its version lower bound of 0 denotes releases before the fixed boundary rather than an independently established introduction version."
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
    "assignerShortName": "esaqa",
    "cveId": "CVE-2026-128970",
    "datePublished": "2026-11-13T14:25:45.811Z",
    "dateReserved": "2026-11-13T13:45:01.621Z",
    "dateUpdated": "2026-11-13T20:05:03.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Eclipse BaSyx Go Components",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThan": "1.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eric Nowak"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule\u0027s `FILTERLIST` fragment filters to single Submodel reads.\u003c/p\u003e\u003cp\u003e`GET /submodels` removes the fields that a rule\u0027s `FILTERLIST` hides, but `GET /submodels/{submodelIdentifier}` and `GET /submodels/{submodelIdentifier}/$metadata` return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example `supplementalSemanticIds` keys that name the other parties allowed to read the Submodel.\u003c/p\u003e\u003cp\u003eIf versioning is enabled (`history.mode` set to `api` or `audit`), `GET /submodels/{submodelIdentifier}/$history` and `GET /shells/{aasIdentifier}/$history` in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule\u0027s formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.\u003c/p\u003e\u003cp\u003eThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.\u003c/p\u003e"
            }
          ],
          "value": "In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule\u0027s `FILTERLIST` fragment filters to single Submodel reads.\n\n\n\n`GET /submodels` removes the fields that a rule\u0027s `FILTERLIST` hides, but `GET /submodels/{submodelIdentifier}` and `GET /submodels/{submodelIdentifier}/$metadata` return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example `supplementalSemanticIds` keys that name the other parties allowed to read the Submodel.\n\n\n\nIf versioning is enabled (`history.mode` set to `api` or `audit`), `GET /submodels/{submodelIdentifier}/$history` and `GET /shells/{aasIdentifier}/$history` in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule\u0027s formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T14:12:17.843Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1371#note_8664220"
        },
        {
          "url": "https://github.com/eclipse-basyx/basyx-go-components/pull/855"
        },
        {
          "url": "https://github.com/eclipse-basyx/basyx-go-components/pull/883"
        },
        {
          "url": "https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3"
        },
        {
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/577"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2026-128790",
    "datePublished": "2026-11-13T14:12:17.843Z",
    "dateReserved": "2026-11-13T07:53:13.412Z",
    "dateUpdated": "2026-11-13T14:12:17.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-128424",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T17:45:21.268673Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T17:45:34.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_streams:3"
          ],
          "defaultStatus": "affected",
          "packageName": "kroxylicious-authorizer-acl",
          "product": "streams for Apache Kafka 3",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Carles Arnal (IBM) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Kroxylicious. The ACL authorizer\u0027s rules-file parser unquotes `matching /\u2026/` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\\d` and `\\w` lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T06:41:03.642Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-128424"
        },
        {
          "name": "RHBZ#2572937",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572937"
        },
        {
          "url": "https://github.com/kroxylicious/kroxylicious/issues/5236"
        },
        {
          "url": "https://github.com/kroxylicious/kroxylicious/pull/5294"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-10T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-28T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Kroxylicious-authorizer-acl: kroxylicious: acl rule file regex escapes are stripped, broadening \u0027matching\u0027 authorization rules",
      "workarounds": [
        {
          "lang": "en",
          "value": "Until a fixed release is available, write regex escapes with doubled backslashes (for example `/orders\\\\.v1/`), audit existing `matching` rules for unintended matches, and prefer exact or `like` predicates where regex matching is not required."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-863: Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-128424",
    "datePublished": "2026-11-13T06:09:19.627Z",
    "dateReserved": "2026-11-13T05:56:28.939Z",
    "dateUpdated": "2026-11-13T17:45:34.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "kit",
          "vendor": "sveltejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.60.1, \u003c 3.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T19:32:58.899Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x"
        },
        {
          "name": "https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60"
        },
        {
          "name": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6cf5-gc4q-fm3x",
        "discovery": "UNKNOWN"
      },
      "title": "SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-128119",
    "datePublished": "2026-11-13T19:32:58.899Z",
    "dateReserved": "2026-11-12T22:42:47.031Z",
    "dateUpdated": "2026-11-13T19:32:58.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.65.0, \u003c 0.65.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, try_sign() captures an Arc\u003cPrivateKey\u003e before awaiting Agent::confirm() and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in the remediation for CVE-2026-116794. A peer, including a remote SSH server using agent forwarding, can begin a confirmation-constrained signature request while the agent is unlocked and receive the signature after another connection locks the agent if the stale confirmation returns true. New post-lock requests are rejected and private key material is not disclosed, but the pending operation bypasses the current lock state. This issue is fixed in version 0.65.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T19:07:42.568Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-736f-c93q-9fwx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-736f-c93q-9fwx"
        },
        {
          "name": "https://github.com/Eugeny/russh/pull/808",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/pull/808"
        },
        {
          "name": "https://github.com/Eugeny/russh/commit/43a46d67a80a7355fcd2fb25e7e00d79aec8184c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/commit/43a46d67a80a7355fcd2fb25e7e00d79aec8184c"
        },
        {
          "name": "https://github.com/Eugeny/russh/releases/tag/v0.65.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.1"
        }
      ],
      "source": {
        "advisory": "GHSA-736f-c93q-9fwx",
        "discovery": "UNKNOWN"
      },
      "title": "russh try_sign: asynchronous confirmation can sign after agent lock"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-128088",
    "datePublished": "2026-11-13T19:07:42.568Z",
    "dateReserved": "2026-11-12T21:24:51.131Z",
    "dateUpdated": "2026-11-13T19:07:42.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-128087",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:15:11.345733Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:15:30.367Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.55.0, \u003c 0.65.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accepts the server host key or certificate. A malicious SSH server can therefore trigger application-defined secondary-channel initialization or early data handling even when the server identity is subsequently rejected. Ordinary clients that keep the callback\u0027s no-op default or independently defer callback-derived actions until trust is confirmed are not affected. This issue is fixed in version 0.65.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696: Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T19:03:26.702Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f"
        },
        {
          "name": "https://github.com/Eugeny/russh/pull/808",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/pull/808"
        },
        {
          "name": "https://github.com/Eugeny/russh/commit/43a46d67a80a7355fcd2fb25e7e00d79aec8184c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/commit/43a46d67a80a7355fcd2fb25e7e00d79aec8184c"
        },
        {
          "name": "https://github.com/Eugeny/russh/releases/tag/v0.65.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9264-jvgf-6w2f",
        "discovery": "UNKNOWN"
      },
      "title": "russh kex_done: shared-secret callback runs before server host-key verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-128087",
    "datePublished": "2026-11-13T19:03:26.702Z",
    "dateReserved": "2026-11-12T21:24:51.131Z",
    "dateUpdated": "2026-11-13T21:15:30.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}