Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
2986 vulnerabilities reference this CWE, most recent first.
CVE-2026-18689 (GCVE-0-2026-18689)
Vulnerability from cvelistv5 – Published: 2026-11-07 04:34 – Updated: 2026-11-08 01:39
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in IBM API Connect
Summary
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-08 01:39 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
ibm
CNA
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295635 | vendor-advisorypatch |
| https://www.ibm.com/support/pages/node/7295637 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | API Connect |
Affected:
12.1.0.0 , ≤ 12.1.1.2
(semver)
Affected: 10.0.8.0 , ≤ 10.0.8.12 (semver) cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-08T01:39:03.779067Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:39:28.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"
],
"product": "API Connect",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "12.1.1.2",
"status": "affected",
"version": "12.1.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.8.12",
"status": "affected",
"version": "10.0.8.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T04:34:38.150Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295635"
},
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295637"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3\u003cbr\u003eFix Central Link: \u003ca href=\"https://www.ibm.com/support/pages/node/7290205\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7290205\u003c/a\u003e\u003c/p\u003e\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link:\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere\u0026amp;product=ibm/WebSphere/IBM+API+Connect\u0026amp;release=10.0.8.12\u0026amp;platform=All\u0026amp;function=all\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere\u0026amp;product=ibm/WebSphere/IBM+API+Connect\u0026amp;release=10.0.8.12\u0026amp;platform=All\u0026amp;function=all\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3\nFix Central Link: https://www.ibm.com/support/pages/node/7290205 \n\n\n\nIBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere\u0026product=ibm/WebSphere/IBM+API+Connect\u0026release=10.0.8.12\u0026platform=All\u0026function=all"
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-18689",
"datePublished": "2026-11-07T04:34:38.150Z",
"dateReserved": "2026-08-03T15:52:54.786Z",
"dateUpdated": "2026-11-08T01:39:28.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18674 (GCVE-0-2026-18674)
Vulnerability from cvelistv5 – Published: 2026-08-17 12:08 – Updated: 2026-08-17 14:46
VLAI
EPSS
VEX
Title
Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
Summary
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone.
The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide.
The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 14:46 UTC
Assigner
Kong
CNA
References
9 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T14:46:37.265087Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T14:46:48.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"kuma-cp"
],
"platforms": [
"Linux"
],
"product": "Kong Mesh",
"vendor": "Kong Inc.",
"versions": [
{
"lessThan": "2.7.29",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.9.19",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
},
{
"lessThan": "2.11.18",
"status": "affected",
"version": "2.10.0",
"versionType": "semver"
},
{
"lessThan": "2.12.14",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.13.10",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.14.2",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eYou are affected only if you run a multi-zone deployment of Kong Mesh. If a threat actor controls, or holds a valid zone token for, at least one enrolled zone they can leverage the issue.\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cspan\u003eYou are not affected if you run a single-zone deployment.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "You are affected only if you run a multi-zone deployment of Kong Mesh. If a threat actor controls, or holds a valid zone token for, at least one enrolled zone they can leverage the issue.\u00a0\n\n\n\nYou are not affected if you run a single-zone deployment."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "johanw"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled \u003ccode\u003eControlPlane.Identifier\u003c/code\u003e rather than the authenticated zone identity derived from the connection. Authenticated zones can have the\u0026nbsp;global control plane store and re-distribute those resources as belonging to another zone.\u003c/p\u003e\u003cp\u003eThe result is a cross-zone isolation bypass: the holder of a single enrolled zone\u0027s credential can inject, attribute, and overwrite resources in another zone\u0027s namespace mesh-wide.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThe root cause lives in Kuma\u0027s open-source KDS sync code, which Kong Mesh\u0027s control plane is built on.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the\u00a0global control plane store and re-distribute those resources as belonging to another zone.\n\n\n\nThe result is a cross-zone isolation bypass: the holder of a single enrolled zone\u0027s credential can inject, attribute, and overwrite resources in another zone\u0027s namespace mesh-wide.\n\n\n\n\nThe root cause lives in Kuma\u0027s open-source KDS sync code, which Kong Mesh\u0027s control plane is built on."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Cross-zone isolation bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T12:08:11.470Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"name": "Upstream advisory GHSA-m58j-fjmc-h3g4",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-m58j-fjmc-h3g4"
},
{
"name": "kumahq/kuma#17456 (master)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17456"
},
{
"name": "kumahq/kuma#17458 (release-2.14 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17458"
},
{
"name": "kumahq/kuma#17461 (release-2.13 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17461"
},
{
"name": "kumahq/kuma#17463 (release-2.12 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17463"
},
{
"name": "kumahq/kuma#17462 (release-2.11 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17462"
},
{
"name": "kumahq/kuma#17460 (release-2.9 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17460"
},
{
"name": "kumahq/kuma#17459 (release-2.7 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17459"
},
{
"name": "Kong Mesh Changelog",
"tags": [
"release-notes"
],
"url": "https://developer.konghq.com/mesh/changelog/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the global KDS ingest path attributes synced resources by the authenticated connection identity instead of the in-band field.\u003c/p\u003e"
}
],
"value": "Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the global KDS ingest path attributes synced resources by the authenticated connection identity instead of the in-band field."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-01T16:58:00.000Z",
"value": "Kong Mesh patched releases published"
}
],
"title": "Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict which zones may enroll and protect zone tokens. No configuration flag disables the in-band attribution, so upgrading is the only fix.\u003c/p\u003e"
}
],
"value": "Restrict which zones may enroll and protect zone tokens. No configuration flag disables the in-band attribution, so upgrading is the only fix."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-18674",
"datePublished": "2026-08-17T12:08:11.470Z",
"dateReserved": "2026-08-03T15:20:40.972Z",
"dateUpdated": "2026-08-17T14:46:48.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18662 (GCVE-0-2026-18662)
Vulnerability from cvelistv5 – Published: 2026-10-15 09:42 – Updated: 2026-10-15 13:28
VLAI
EPSS
VEX
Summary
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.
Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:27 UTC
CWE
Assigner
eclipse
CNA
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation |
Affected:
12.1.0 , ≤ 12.1.11
(semver)
|
||
| Eclipse Foundation |
Affected:
12.1.0 , ≤ 12.1.11
(semver)
Affected: 12.0.0 , ≤ 12.0.38 (semver) |
||
| Eclipse Foundation |
Affected:
11.0.0 , ≤ 11.0.32
(semver)
Affected: 10.0.0 , ≤ 10.0.32 (semver) Affected: 7.6.13 , ≤ 9.4.64 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18662",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:27:43.242446Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T13:28:30.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-phjh-v7c6-g7mv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee11:jetty-ee11-servlet",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee10:jetty-ee10-servlet",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee9:jetty-ee9-security",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee8:jetty-ee8-security",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty:jetty-security",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "11.0.32",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.32",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.64",
"status": "affected",
"version": "7.6.13",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/4ra1n"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.\u003c/p\u003e\u003cp\u003eResulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.\u003c/p\u003e"
}
],
"value": "In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.\n\n\n\nResulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T11:35:32.815Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-phjh-v7c6-g7mv"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/210"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-18662",
"datePublished": "2026-10-15T09:42:40.638Z",
"dateReserved": "2026-08-03T13:22:01.555Z",
"dateUpdated": "2026-10-15T13:28:30.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18661 (GCVE-0-2026-18661)
Vulnerability from cvelistv5 – Published: 2026-10-15 09:01 – Updated: 2026-10-15 13:46
VLAI
EPSS
VEX
Summary
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:46 UTC
CWE
Assigner
eclipse
CNA
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation |
Affected:
12.1.0 , ≤ 12.1.11
(semver)
|
||
| Eclipse Foundation |
Affected:
12.1.0 , ≤ 12.1.11
(semver)
Affected: 12.0.0 , ≤ 12.0.38 (semver) |
||
| Eclipse Foundation |
Affected:
11.0.0 , ≤ 11.0.32
(semver)
Affected: 10.0.0 , ≤ 10.0.32 (semver) Affected: 9.4.0 , ≤ 9.4.64 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18661",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:46:08.767812Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T13:46:37.040Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-v6xf-996f-c35f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee11:jetty-ee11-annotations",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee10:jetty-ee10-annotations",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee9:jetty-ee9-annotations",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee8:jetty-ee8-annotations",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty:jetty-annotations",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "11.0.32",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.32",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.64",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by https://github.com/4ra1n"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.\u003c/p\u003e"
}
],
"value": "In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T09:34:51.854Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-v6xf-996f-c35f"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/211"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-18661",
"datePublished": "2026-10-15T09:01:28.668Z",
"dateReserved": "2026-08-03T13:21:55.359Z",
"dateUpdated": "2026-10-15T13:46:37.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18659 (GCVE-0-2026-18659)
Vulnerability from cvelistv5 – Published: 2026-10-15 09:44 – Updated: 2026-10-15 13:26
VLAI
EPSS
VEX
Title
Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
Summary
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:24 UTC
CWE
Assigner
eclipse
CNA
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation |
Affected:
12.1.0 , ≤ 12.1.11
(semver)
|
||
| Eclipse Foundation |
Affected:
12.1.0 , ≤ 12.1.11
(semver)
Affected: 12.0.0 , ≤ 12.0.38 (semver) |
||
| Eclipse Foundation |
Affected:
11.0.0 , ≤ 11.0.32
(semver)
Affected: 10.0.0 , ≤ 10.0.32 (semver) Affected: 7.6.13 , ≤ 9.4.64 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18659",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:24:19.948451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T13:26:19.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-53x7-f9fc-h7qr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee11:jetty-ee11-servlet",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee10:jetty-ee10-servlet",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee9:jetty-ee9-security",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty.ee8:jetty-ee8-security",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.11",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.38",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2/",
"defaultStatus": "unaffected",
"packageName": "org.eclipse.jetty:jetty-security",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "11.0.32",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.32",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.64",
"status": "affected",
"version": "7.6.13",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/thientd"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.\u003c/p\u003e"
}
],
"value": "In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T11:34:12.686Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-53x7-f9fc-h7qr"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/214"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-18659",
"datePublished": "2026-10-15T09:44:11.148Z",
"dateReserved": "2026-08-03T13:20:03.063Z",
"dateUpdated": "2026-10-15T13:26:19.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18635 (GCVE-0-2026-18635)
Vulnerability from cvelistv5 – Published: 2026-08-11 14:15 – Updated: 2026-08-12 18:36
VLAI
EPSS
VEX
Title
Velociraptor query plugin allows impersonation in other orgs
Summary
Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org.
This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:36 UTC
CWE
Assigner
rapid7
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rapid7 | Velociraptor |
Affected:
0 , < 0.77.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:36:40.599653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:36:53.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Velociraptor",
"repo": "https://github.com/Velocidex/velociraptor/",
"vendor": "Rapid7",
"versions": [
{
"lessThan": "0.77.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "To exploit this vulnerability, the caller must be an administrator role at an org."
}
],
"value": "To exploit this vulnerability, the caller must be an administrator role at an org."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Itay Vardi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVelociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\u003c/p\u003e\u003cdiv\u003eThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.\u003c/div\u003e"
}
],
"value": "Velociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\n\nThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:31:17.811Z",
"orgId": "9974b330-7714-4307-a722-5648477acda7",
"shortName": "rapid7"
},
"references": [
{
"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18635/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Velociraptor query plugin allows impersonation in other orgs",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Ensure administrator users in child orgs are trusted."
}
],
"value": "Ensure administrator users in child orgs are trusted."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
"assignerShortName": "rapid7",
"cveId": "CVE-2026-18635",
"datePublished": "2026-08-11T14:15:58.493Z",
"dateReserved": "2026-08-03T10:21:23.981Z",
"dateUpdated": "2026-08-12T18:36:53.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18572 (GCVE-0-2026-18572)
Vulnerability from cvelistv5 – Published: 2026-08-02 05:18 – Updated: 2026-09-16 18:34
VLAI
EPSS
VEX
Title
Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes
Summary
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 15:51 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
redhat
CNA
References
4 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:68277 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:68278 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-18572 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2509763 | issue-trackingx_refsource_REDHAT |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.6 |
Unaffected:
26.6.7-3 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.6::el9 |
|
| Red Hat | Red Hat build of Keycloak 26.6 |
Unaffected:
26.6-20 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.6::el9 |
|
| Red Hat | Red Hat build of Keycloak 26.6.7 |
cpe:/a:redhat:build_keycloak:26.6::el9
|
|
| Red Hat | Red Hat Data Grid 8 |
cpe:/a:redhat:jboss_data_grid:8
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
|
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
Date Public
2026-07-30 10:07
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T15:51:08.005640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:51:23.871Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6.7-3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6-20",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6-20",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat build of Keycloak 26.6.7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.6.7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat build of Keycloak 26.6.7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Paul Bottinelli (Trail of Bits in collaboration with OpenAI) for reporting this issue."
}
],
"datePublic": "2026-07-30T10:07:47.000Z",
"descriptions": [
{
"lang": "en",
"value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:34:41.593Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:68277",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68277"
},
{
"name": "RHSA-2026:68278",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68278"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-18572"
},
{
"name": "RHBZ#2509763",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-30T10:07:47.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-07-30T10:07:47.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-863: Incorrect Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-18572",
"datePublished": "2026-08-02T05:18:58.904Z",
"dateReserved": "2026-08-02T05:15:43.624Z",
"dateUpdated": "2026-09-16T18:34:41.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18551 (GCVE-0-2026-18551)
Vulnerability from cvelistv5 – Published: 2026-10-16 06:56 – Updated: 2026-10-20 13:11
VLAI
EPSS
VEX
Title
Mattermost guest account privilege escalation via member roles API
Summary
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-17 03:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
Mattermost
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.10.0 , ≤ 11.10.0
(semver)
Affected: 11.7.0 , ≤ 11.7.9 (semver) Affected: 11.9.0 , ≤ 11.9.1 (semver) Affected: 11.8.0 , ≤ 11.8.5 (semver) Unaffected: 11.11.0 Unaffected: 11.10.1 Unaffected: 11.7.10 Unaffected: 11.9.2 Unaffected: 11.8.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-17T03:55:37.074789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:11:28.823Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.10.0",
"status": "affected",
"version": "11.10.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.9",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.9.1",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.5",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.11.0"
},
{
"status": "unaffected",
"version": "11.10.1"
},
{
"status": "unaffected",
"version": "11.7.10"
},
{
"status": "unaffected",
"version": "11.9.2"
},
{
"status": "unaffected",
"version": "11.8.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0x7oda7123"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.10.x \u003c= 11.10.0, 11.7.x \u003c= 11.7.9, 11.9.x \u003c= 11.9.1, 11.8.x \u003c= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:56:51.996Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00752",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.11.0, 11.10.1, 11.7.10, 11.9.2, 11.8.6 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00752",
"defect": [
"https://mattermost.atlassian.net/browse/MM-70072"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost guest account privilege escalation via member roles API",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-18551",
"datePublished": "2026-10-16T06:56:51.996Z",
"dateReserved": "2026-07-31T23:37:44.233Z",
"dateUpdated": "2026-10-20T13:11:28.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18433 (GCVE-0-2026-18433)
Vulnerability from cvelistv5 – Published: 2026-08-12 19:04 – Updated: 2026-08-13 14:42
VLAI
EPSS
VEX
Title
Incorrect Authorization in GitLab
Summary
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:42 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
GitLab
CNA
References
3 references
| URL | Tags |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/work_items… | |
| https://hackerone.com/reports/3776182 | technical-descriptionexploitpermissions-required |
| https://docs.gitlab.com/releases/patches/patch-re… |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:42:18.635245Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:42:24.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "GitLab",
"repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
"vendor": "GitLab",
"versions": [
{
"lessThan": "19.1.4",
"status": "affected",
"version": "19.1",
"versionType": "semver"
},
{
"lessThan": "19.2.2",
"status": "affected",
"version": "19.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thanks [anshuman_bh](https://hackerone.com/anshuman_bh) for reporting this vulnerability through our HackerOne bug bounty program"
}
],
"descriptions": [
{
"lang": "en",
"value": "GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:04:26.420Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/607556"
},
{
"name": "HackerOne Bug Bounty Report #3776182",
"tags": [
"technical-description",
"exploit",
"permissions-required"
],
"url": "https://hackerone.com/reports/3776182"
},
{
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 19.1.4, 19.2.2 or above."
}
],
"title": "Incorrect Authorization in GitLab"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-18433",
"datePublished": "2026-08-12T19:04:26.420Z",
"dateReserved": "2026-07-30T20:04:25.029Z",
"dateUpdated": "2026-08-13T14:42:24.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18394 (GCVE-0-2026-18394)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:34 – Updated: 2026-07-31 20:01
VLAI
EPSS
VEX
Title
Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration
Summary
Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.
To remediate this issue, users should upgrade to version 0.8.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 20:00 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
AMZN
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/strands-agents/tools/releases/… | patch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/strands-agents/tools/security/… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | Strands Agents Tools |
Affected:
0 , < 0.8.2
(custom)
cpe:2.3:a:aws:strands_agents_tools:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18394",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T20:00:54.657017Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:01:07.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Strands Agents Tools",
"vendor": "AWS",
"versions": [
{
"lessThan": "0.8.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:strands_agents_tools:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.8.2",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version 0.8.2.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.\n\n\n\nTo remediate this issue, users should upgrade to version 0.8.2."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:39:12.134Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/strands-agents/tools/releases/tag/v0.8.2"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-069-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/strands-agents/tools/security/advisories/GHSA-qhw6-2h72-m84v"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-18394",
"datePublished": "2026-07-31T19:34:15.007Z",
"dateReserved": "2026-07-30T14:47:05.047Z",
"dateUpdated": "2026-07-31T20:01:07.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.