Common Weakness Enumeration
CWE-522
Allowed-with-ReviewInsufficiently Protected Credentials
Abstraction: Class · Status: Incomplete
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
643 vulnerabilities reference this CWE, most recent first.
CVE-2026-116244 (GCVE-0-2026-116244)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:55 – Updated: 2026-11-06 16:14
VLAI
EPSS
VEX
Title
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
Summary
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account running pgAdmin. libpq then answered any server that asked for GSSAPI authentication with that account's ticket, whatever user name the pgAdmin user gave, so in server mode any user could connect as the service account's Kerberos principal; gssencmode=disable did not prevent it. On Windows, SSPI used the service account's logon in the same way. psql was also started with pgAdmin's environment, which could hold another user's credential cache while that user was connecting.
The fix points KRB5CCNAME and KRB5_CLIENT_KTNAME at a file that cannot exist except while a Kerberos-authenticated user connects with Kerberos, and gives every other connection, psql and the utilities require_auth=!gss,!sspi and gssencmode=disable, checked on the final connection string. require_auth needs libpq 16 or later.
This issue affects pgAdmin 4: before 9.19.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:14 UTC
CWE
Assigner
PostgreSQL
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/10655 | issue-tracking |
| https://github.com/pgadmin-org/pgadmin4/commit/14… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgadmin.org | pgAdmin 4 |
Affected:
0 , < 9.19
(custom)
|
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116244",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:14:35.426733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:14:48.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Servers",
"Authentication",
"PSQL Tool",
"Backup",
"Restore"
],
"product": "pgAdmin 4",
"programFiles": [
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py",
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/locker.py"
],
"repo": "https://github.com/pgadmin-org/pgadmin4",
"vendor": "pgadmin.org",
"versions": [
{
"lessThan": "9.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Dave Page \u003cdpage@pgadmin.org\u003e"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Kundan Sable \u003ckundan.sable@enterprisedb.com\u003e"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Hitesh Jambhale \u003chitesh.jambhale@enterprisedb.com\u003e"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Ashesh Vashi \u003cashesh.vashi@enterprisedb.com\u003e"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When a pgAdmin 4 connection was not meant to use a Kerberos user\u0027s delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account running pgAdmin. libpq then answered any server that asked for GSSAPI authentication with that account\u0027s ticket, whatever user name the pgAdmin user gave, so in server mode any user could connect as the service account\u0027s Kerberos principal; gssencmode=disable did not prevent it. On Windows, SSPI used the service account\u0027s logon in the same way. psql was also started with pgAdmin\u0027s environment, which could hold another user\u0027s credential cache while that user was connecting.\n\nThe fix points KRB5CCNAME and KRB5_CLIENT_KTNAME at a file that cannot exist except while a Kerberos-authenticated user connects with Kerberos, and gives every other connection, psql and the utilities require_auth=!gss,!sspi and gssencmode=disable, checked on the final connection string. require_auth needs libpq 16 or later.\n\nThis issue affects pgAdmin 4: before 9.19."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Any authenticated user who can register a server. Attack Complexity is High: the service account must hold a credential cache or keytab, or run on a domain-joined Windows host, and a reachable server must accept that principal. Scope is Changed because the connection is made as the service account\u0027s principal, an identity the attacker was never granted; Confidentiality and Integrity are High on that database server. Availability is None."
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Same reasoning as the CVSS 3.1 entry. AT:P for the Kerberos deployment conditions. VC:H because the service account\u0027s credential is used through pgAdmin; SC:H/SI:H for the database server reached with it."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:55:15.101Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/pgadmin-org/pgadmin4/issues/10655"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/145e511f05eed69ebcadd3cd61ffea0a5b4c69a4"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "pgAdmin 4: libpq uses the pgAdmin service account\u0027s Kerberos credentials"
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116244",
"datePublished": "2026-10-30T19:55:15.101Z",
"dateReserved": "2026-10-25T16:26:16.419Z",
"dateUpdated": "2026-11-06T16:14:48.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116242 (GCVE-0-2026-116242)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:55 – Updated: 2026-11-06 16:11
VLAI
EPSS
VEX
Title
pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
Summary
pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account's ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account's key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account.
The fix makes tunnels in server mode use only the identity file or password the user configured: the service account's keys, configuration and agent are no longer used, and an identity file that cannot be found in the user's storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.
This issue affects pgAdmin 4: before 9.19.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:11 UTC
CWE
Assigner
PostgreSQL
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/10662 | issue-tracking |
| https://github.com/pgadmin-org/pgadmin4/commit/d5… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgadmin.org | pgAdmin 4 |
Affected:
0 , < 9.19
(custom)
|
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:11:06.590799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:11:29.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Servers"
],
"product": "pgAdmin 4",
"programFiles": [
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py"
],
"repo": "https://github.com/pgadmin-org/pgadmin4",
"vendor": "pgadmin.org",
"versions": [
{
"lessThan": "9.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Dave Page \u003cdpage@pgadmin.org\u003e"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Kundan Sable \u003ckundan.sable@enterprisedb.com\u003e"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Hitesh Jambhale \u003chitesh.jambhale@enterprisedb.com\u003e"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Ashesh Vashi \u003cashesh.vashi@enterprisedb.com\u003e"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account\u0027s ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account\u0027s key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account.\n\nThe fix makes tunnels in server mode use only the identity file or password the user configured: the service account\u0027s keys, configuration and agent are no longer used, and an identity file that cannot be found in the user\u0027s storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.\n\nThis issue affects pgAdmin 4: before 9.19."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Any authenticated user who can register a server with an SSH tunnel. Attack Complexity is High: the service account must have an unencrypted default key, agent or configuration that a host the attacker can name accepts. Scope is Changed because the tunnel authenticates as the service account to another system, an identity the attacker was never granted; Confidentiality and Integrity are High for the access it gives. Availability is None."
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Same reasoning as the CVSS 3.1 entry. AT:P for the service account\u0027s SSH identity and an accepting host. VC:H because the service account\u0027s key is used through pgAdmin; SC:H/SI:H for the SSH host and the network reached through it."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:55:13.843Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/pgadmin-org/pgadmin4/issues/10662"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/d52fe4740eb1af89d940f2e412bd66a0a89f08bb"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "pgAdmin 4: SSH tunnels use the pgAdmin service account\u0027s own SSH identity"
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116242",
"datePublished": "2026-10-30T19:55:13.843Z",
"dateReserved": "2026-10-25T16:26:16.419Z",
"dateUpdated": "2026-11-06T16:11:29.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115750 (GCVE-0-2026-115750)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:03 – Updated: 2026-11-04 20:36
VLAI
EPSS
VEX
Title
mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects
Summary
mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:35 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/agentfront/mcp-from-openapi/se… | vendor-advisory |
| https://github.com/agentfront/mcp-from-openapi/pull/42 | issue-trackingpatch |
| https://github.com/agentfront/mcp-from-openapi/co… | patch |
| https://github.com/agentfront/mcp-from-openapi/re… | release-notes |
| https://www.vulncheck.com/advisories/mcp-from-ope… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| agentfront | mcp-from-openapi |
Affected:
2.5.0 , < 2.9.0
(semver)
cpe:2.3:a:frontmcp:mcp-from-openapi:*:*:*:*:*:*:*:* |
Date Public
2026-10-20 03:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115750",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:35:55.841644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:36:16.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/agentfront/mcp-from-openapi/security/advisories/GHSA-ff5q-5r4v-fw4v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/mcp-from-openapi",
"product": "mcp-from-openapi",
"repo": "https://github.com/agentfront/mcp-from-openapi",
"vendor": "agentfront",
"versions": [
{
"lessThan": "2.9.0",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frontmcp:mcp-from-openapi:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.9.0",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani (AploSec)"
}
],
"datePublic": "2026-10-20T03:22:53.000Z",
"descriptions": [
{
"lang": "en",
"value": "mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:03:32.783Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ff5q-5r4v-fw4v)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/agentfront/mcp-from-openapi/security/advisories/GHSA-ff5q-5r4v-fw4v"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/agentfront/mcp-from-openapi/pull/42"
},
{
"tags": [
"patch"
],
"url": "https://github.com/agentfront/mcp-from-openapi/commit/47fb7a655de33958b0c923490ab244343eb5fc44"
},
{
"name": "mcp-from-openapi v2.9.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.9.0"
},
{
"name": "VulnCheck Advisory: mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mcp-from-openapi-from-2.5.0-before-2.9.0-credential-leak-via-cross-origin-redirects"
}
],
"title": "mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115750",
"datePublished": "2026-10-23T13:03:32.783Z",
"dateReserved": "2026-10-23T12:59:06.316Z",
"dateUpdated": "2026-11-04T20:36:16.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115371 (GCVE-0-2026-115371)
Vulnerability from cvelistv5 – Published: 2026-10-22 19:13 – Updated: 2026-11-05 16:18
VLAI
EPSS
VEX
Title
LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints
Summary
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:17 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/lxc/incus/security/advisories/… | vendor-advisory |
| https://www.vulncheck.com/advisories/lxc-incus-6.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| lxc | incus |
Affected:
6.0.3 , < 6.0.7
(semver)
Unaffected: 6.0.7 (semver) Affected: 6.6.0 , < 7.0.2 (semver) Unaffected: 7.0.2 (semver) Affected: 7.1.0 , < 7.5.0 (semver) Unaffected: 7.5.0 (semver) cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* |
Date Public
2026-09-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:17:58.611961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:18:09.038Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd",
"product": "incus",
"vendor": "lxc",
"versions": [
{
"lessThan": "6.0.7",
"status": "affected",
"version": "6.0.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.0.7",
"versionType": "semver"
},
{
"lessThan": "7.0.2",
"status": "affected",
"version": "6.6.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.0.2",
"versionType": "semver"
},
{
"lessThan": "7.5.0",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.5.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.7",
"versionStartIncluding": "6.0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.2",
"versionStartIncluding": "6.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.5.0",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
},
{
"lang": "en",
"type": "finder",
"value": "stgraber"
},
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-09-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T19:13:41.898Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x8gj-2q73-qr6j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j"
},
{
"name": "VulnCheck Advisory: LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lxc-incus-6.0.3-before-6.0.7-6.6.0-before-7.0.2-and-7.1.0-before-7.5.0-bucket-credential-disclosure-via-storage-bucket-keys-endpoints"
}
],
"title": "LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115371",
"datePublished": "2026-10-22T19:13:41.898Z",
"dateReserved": "2026-10-22T11:24:28.626Z",
"dateUpdated": "2026-11-05T16:18:09.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115340 (GCVE-0-2026-115340)
Vulnerability from cvelistv5 – Published: 2026-11-09 16:47 – Updated: 2026-11-09 16:47
VLAI
EPSS
VEX
Title
Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server
Summary
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
Severity
7.1 (High)
CWE
Assigner
ProgressSoftware
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/WS-FTP-S… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2025.0.5
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2025.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Momen Elmady (0xmatrix)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations."
}
],
"value": "Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Collect Data from Common Resource Locations"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312: Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T16:47:31.408Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eShorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-115340",
"datePublished": "2026-11-09T16:47:31.408Z",
"dateReserved": "2026-10-22T10:41:52.792Z",
"dateUpdated": "2026-11-09T16:47:31.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114221 (GCVE-0-2026-114221)
Vulnerability from cvelistv5 – Published: 2026-10-22 04:26 – Updated: 2026-10-30 18:28
VLAI
EPSS
VEX
Title
NewType Infortech｜NT OneAPP - Credential Disclosure
Summary
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:28 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
twcert
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NewType Infortech | NT OneAPP |
Affected:
0 , ≤ 1.5.22
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114221",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T18:28:24.979909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:28:58.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NT OneAPP",
"vendor": "NewType Infortech",
"versions": [
{
"lessThanOrEqual": "1.5.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.\u003c/p\u003e"
}
],
"value": "NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T04:26:43.979Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html"
},
{
"url": "https://www.twcert.org.tw/tw/cp-132-11298-d9dd5-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate to NT OneAPP version 1.5.35 or later\u003c/p\u003e"
}
],
"value": "Update to NT OneAPP version 1.5.35 or later"
}
],
"source": {
"advisory": "TVN-202610006",
"discovery": "EXTERNAL"
},
"title": "NewType Infortech\uff5cNT OneAPP - Credential Disclosure",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2026-114221",
"datePublished": "2026-10-22T04:26:43.979Z",
"dateReserved": "2026-10-21T03:36:57.115Z",
"dateUpdated": "2026-10-30T18:28:58.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114070 (GCVE-0-2026-114070)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 15:50
VLAI
EPSS
VEX
Title
Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records
Summary
Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:24 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/triggerdotdev/trigger.dev/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/trigger-dev-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| triggerdotdev | trigger.dev |
Affected:
4.5.0 , < 4.6.0
(semver)
Unaffected: 4.6.0 (semver) |
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114070",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:24:58.597893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:50:25.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "trigger.dev",
"vendor": "triggerdotdev",
"versions": [
{
"lessThan": "4.6.0",
"status": "affected",
"version": "4.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Str1ckl4nd"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat\u0027s public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:36:41.635Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wpp9-mq73-fhqm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-wpp9-mq73-fhqm"
},
{
"name": "VulnCheck Advisory: Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/trigger-dev-4.5.0-before-4.6.0-dashboard-agent-user-token-disclosure-via-session-records"
}
],
"title": "Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114070",
"datePublished": "2026-10-21T00:36:41.635Z",
"dateReserved": "2026-10-20T21:43:23.219Z",
"dateUpdated": "2026-10-21T15:50:25.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113733 (GCVE-0-2026-113733)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:42 – Updated: 2026-11-03 18:26
VLAI
EPSS
VEX
Title
Password hash disclosure to "view only" admin users with custom user models
Summary
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.
The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:19 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
DSF
CNA
References
6 references
| URL | Tags |
|---|---|
| https://docs.djangoproject.com/en/dev/releases/se… | vendor-advisory |
| https://groups.google.com/g/django-announce | mailing-list |
| https://github.com/django/django/commit/f5b039a61… | patch |
| https://github.com/django/django/commit/7d875c0a4… | patch |
| https://github.com/django/django/commit/67cce9dcd… | patch |
| https://www.djangoproject.com/weblog/2026/nov/03/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| djangoproject | Django |
Affected:
6.1 , < 6.1.3
(python)
Unaffected: 6.1.3 (python) Affected: 6.0 , < 6.0.10 (python) Unaffected: 6.0.10 (python) |
Date Public
2026-11-03 09:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:19:20.522532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:26:15.014Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/Django/",
"defaultStatus": "unaffected",
"packageName": "django",
"product": "Django",
"repo": "https://github.com/django/django/",
"vendor": "djangoproject",
"versions": [
{
"lessThan": "6.1.3",
"status": "affected",
"version": "6.1",
"versionType": "python"
},
{
"status": "unaffected",
"version": "6.1.3",
"versionType": "python"
},
{
"lessThan": "6.0.10",
"status": "affected",
"version": "6.0",
"versionType": "python"
},
{
"status": "unaffected",
"version": "6.0.10",
"versionType": "python"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Aaron chen"
},
{
"lang": "en",
"type": "analyst",
"value": "Jake Howard"
},
{
"lang": "en",
"type": "analyst",
"value": "Natalia Bidart"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Natalia Bidart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jake Howard"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jacob Walls"
}
],
"datePublic": "2026-11-03T09:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.\u003c/p\u003e\u003cp\u003eThe \u003ccode\u003edjango.contrib.admin.utils.display_for_field()\u003c/code\u003e function did not obfuscate the password field of user models other than \u003ccode\u003eAUTH_USER_MODEL\u003c/code\u003e, or of an \u003ccode\u003eAUTH_USER_MODEL\u003c/code\u003e inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Aaron chen for reporting this issue.\u003c/p\u003e"
}
],
"value": "An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.\nThe `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116: Excavation"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
"value": "low"
},
"type": "Django severity rating"
}
},
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:42:48.058Z",
"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
"shortName": "DSF"
},
"references": [
{
"name": "Django security archive",
"tags": [
"vendor-advisory"
],
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"name": "Django releases announcements",
"tags": [
"mailing-list"
],
"url": "https://groups.google.com/g/django-announce"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/f5b039a619b3b5394ea5b966e17c7546fda6f937"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/7d875c0a49d2a59335c65f6bf57970a5bac03be2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365"
},
{
"name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19",
"tags": [
"vendor-advisory"
],
"url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-10-07T12:00:00.000Z",
"value": "Initial report received."
},
{
"lang": "en",
"time": "2026-10-23T12:00:00.000Z",
"value": "Vulnerability confirmed."
},
{
"lang": "en",
"time": "2026-11-03T09:30:00.000Z",
"value": "Security release issued."
}
],
"title": "Password hash disclosure to \"view only\" admin users with custom user models",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
"assignerShortName": "DSF",
"cveId": "CVE-2026-113733",
"datePublished": "2026-11-03T15:42:48.058Z",
"dateReserved": "2026-10-20T16:07:10.868Z",
"dateUpdated": "2026-11-03T18:26:15.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113652 (GCVE-0-2026-113652)
Vulnerability from cvelistv5 – Published: 2026-10-20 16:26 – Updated: 2026-10-21 15:53
VLAI
EPSS
VEX
Title
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
Summary
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:24 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.33.0
|
|
| apostrophecms | uploadfs |
Affected:
>= 1.25.0, < 1.28.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:24:35.042848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:53:38.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.33.0"
}
]
},
{
"product": "uploadfs",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.25.0, \u003c 1.28.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:26:21.986Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhph-8536-gfq5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhph-8536-gfq5"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0"
}
],
"source": {
"advisory": "GHSA-hhph-8536-gfq5",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113652",
"datePublished": "2026-10-20T16:26:21.986Z",
"dateReserved": "2026-10-20T14:27:46.640Z",
"dateUpdated": "2026-10-21T15:53:38.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113440 (GCVE-0-2026-113440)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:49 – Updated: 2026-11-02 21:11
VLAI
EPSS
VEX
Title
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Summary
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.
This issue affects hackney: from 2.0.0 before 4.9.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 21:11 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
EEF
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/benoitc/hackney/pull/979 | related |
| https://cna.erlef.org/cves/CVE-2026-113440.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-113440 | related |
| https://github.com/benoitc/hackney/releases/tag/4.9.0 | vendor-advisoryrelated |
| https://github.com/benoitc/hackney/commit/8f94455… | related |
| https://github.com/benoitc/hackney/commit/6548384… | patch |
Impacted products
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T21:11:36.228424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T21:11:47.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney.erl"
],
"programRoutines": [
{
"name": "hackney:request/5"
},
{
"name": "hackney:follow_redirect/10"
},
{
"name": "hackney:maybe_strip_auth_on_redirect/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney.erl"
],
"programRoutines": [
{
"name": "hackney:request/5"
},
{
"name": "hackney:follow_redirect/10"
},
{
"name": "hackney:maybe_strip_auth_on_redirect/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "6548384b22ea196023a1963e2967d5715b6d9564",
"status": "affected",
"version": "8f944559bdb83da60b5c06f6cf6d842591278364",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe request is made with \u003ccode\u003efollow_redirect\u003c/code\u003e enabled and the \u003ccode\u003ebasic_auth\u003c/code\u003e or \u003ccode\u003ecookie\u003c/code\u003e option set, over HTTP/1.1 or HTTP/2, without \u003ccode\u003elocation_trusted\u003c/code\u003e. Credentials passed as explicit request headers are not forwarded on redirects and are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The request is made with `follow_redirect` enabled and the `basic_auth` or `cookie` option set, over HTTP/1.1 or HTTP/2, without `location_trusted`. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."
}
],
"value": "The request is made with follow_redirect enabled and the basic_auth or cookie option set, over HTTP/1.1 or HTTP/2, without location_trusted. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T10:04:03.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficiently Protected Credentials vulnerability in \u003ccode\u003ehackney\u003c/code\u003e in benoitc hackney allows a redirecting server to obtain the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e credentials of a request via a same-host redirect to another scheme or port. With \u003ccode\u003efollow_redirect\u003c/code\u003e enabled, \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e in \u003ccode\u003esrc/hackney.erl\u003c/code\u003e reissues the request to the \u003ccode\u003eLocation\u003c/code\u003e target after \u003ccode\u003ehackney:maybe_strip_auth_on_redirect/3\u003c/code\u003e, which compared only the hostname of the current and the redirect URL. A redirect from \u003ccode\u003ehttps\u003c/code\u003e to \u003ccode\u003ehttp\u003c/code\u003e on the same host resent the \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. \u003ccode\u003elocation_trusted\u003c/code\u003e forwards credentials to any target by design and is unchanged.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Insufficiently Protected Credentials vulnerability in `hackney` in benoitc hackney allows a redirecting server to obtain the `basic_auth` and `cookie` credentials of a request via a same-host redirect to another scheme or port. With `follow_redirect` enabled, `hackney:follow_redirect/10` in `src/hackney.erl` reissues the request to the `Location` target after `hackney:maybe_strip_auth_on_redirect/3`, which compared only the hostname of the current and the redirect URL. A redirect from `https` to `http` on the same host resent the `Authorization` and `Cookie` headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. `location_trusted` forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"value": "Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-102",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s `Authorization` and `Cookie` headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."
}
],
"value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s Authorization and Cookie headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:49:17.377Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Strip basic_auth and cookie on redirects that change scheme or port (benoitc/hackney#979)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/979"
},
{
"name": "EEF CNA record for CVE-2026-113440",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-113440.html"
},
{
"name": "OSV record EEF-CVE-2026-113440",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-113440"
},
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "Introducing commit 8f94455 in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364"
},
{
"name": "Fix commit 6548384 in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable \u003ccode\u003efollow_redirect\u003c/code\u003e and handle the \u003ccode\u003eLocation\u003c/code\u003e header in the application, or pass the credentials as explicit \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e request headers instead of the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e options. \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e issues the redirected request with an empty header list, so explicit headers reach the first server only.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Disable `follow_redirect` and handle the `Location` header in the application, or pass the credentials as explicit `Authorization` and `Cookie` request headers instead of the `basic_auth` and `cookie` options. `hackney:follow_redirect/10` issues the redirected request with an empty header list, so explicit headers reach the first server only."
}
],
"value": "Disable follow_redirect and handle the Location header in the application, or pass the credentials as explicit Authorization and Cookie request headers instead of the basic_auth and cookie options. hackney:follow_redirect/10 issues the redirected request with an empty header list, so explicit headers reach the first server only."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Redirect handling.\u003c/strong\u003e With \u003ccode\u003efollow_redirect\u003c/code\u003e set, \u003ccode\u003ehackney:request/5\u003c/code\u003e hands a 3xx response to \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e in \u003ccode\u003esrc/hackney.erl\u003c/code\u003e, which resolves the \u003ccode\u003eLocation\u003c/code\u003e header against the current URL and calls \u003ccode\u003ehackney:request/5\u003c/code\u003e again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Host-only comparison.\u003c/strong\u003e Before the new request, \u003ccode\u003ehackney:maybe_strip_auth_on_redirect/3\u003c/code\u003e removes the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e options when the redirect leaves the current host, unless \u003ccode\u003elocation_trusted\u003c/code\u003e is set. It compared \u003ccode\u003e#hackney_url.host\u003c/code\u003e of the two URLs.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Consequence.\u003c/strong\u003e A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers. From \u003ccode\u003ehttps\u003c/code\u003e to \u003ccode\u003ehttp\u003c/code\u003e they travel in cleartext; to another port they reach a different service on the same host.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Redirect handling.** With `follow_redirect` set, `hackney:request/5` hands a 3xx response to `hackney:follow_redirect/10` in `src/hackney.erl`, which resolves the `Location` header against the current URL and calls `hackney:request/5` again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n**2. Host-only comparison.** Before the new request, `hackney:maybe_strip_auth_on_redirect/3` removes the `basic_auth` and `cookie` options when the redirect leaves the current host, unless `location_trusted` is set. It compared `#hackney_url.host` of the two URLs.\n\n**3. Consequence.** A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same `Authorization` and `Cookie` headers. From `https` to `http` they travel in cleartext; to another port they reach a different service on the same host."
}
],
"value": "1. Redirect handling. With follow_redirect set, hackney:request/5 hands a 3xx response to hackney:follow_redirect/10 in src/hackney.erl, which resolves the Location header against the current URL and calls hackney:request/5 again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n2. Host-only comparison. Before the new request, hackney:maybe_strip_auth_on_redirect/3 removes the basic_auth and cookie options when the redirect leaves the current host, unless location_trusted is set. It compared #hackney_url.host of the two URLs.\n\n3. Consequence. A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same Authorization and Cookie headers. From https to http they travel in cleartext; to another port they reach a different service on the same host."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-113440",
"datePublished": "2026-10-26T13:49:17.377Z",
"dateReserved": "2026-10-26T10:00:02.149Z",
"dateUpdated": "2026-11-02T21:11:47.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Use an appropriate security mechanism to protect the credentials.
Mitigation
Architecture and Design
Make appropriate use of cryptography to protect the credentials.
Mitigation
Implementation
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
CAPEC-102: Session Sidejacking
Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
CAPEC-474: Signature Spoofing by Key Theft
An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.
CAPEC-509: Kerberoasting
Through the exploitation of how service accounts leverage Kerberos authentication with Service Principal Names (SPNs), the adversary obtains and subsequently cracks the hashed credentials of a service account target to exploit its privileges. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. As an authenticated user, the adversary may request Active Directory and obtain a service ticket with portions encrypted via RC4 with the private key of the authenticated account. By extracting the local ticket and saving it disk, the adversary can brute force the hashed value to reveal the target account credentials.
CAPEC-551: Modify Existing Service
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.
CAPEC-555: Remote Services with Stolen Credentials
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-561: Windows Admin Shares with Stolen Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-644: Use of Captured Hashes (Pass The Hash)
An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.
CAPEC-645: Use of Captured Tickets (Pass The Ticket)
An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depending on the ticket obtained, the adversary may be able to access a particular resource or generate TGTs for any account within an Active Directory Domain.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.