CVE-2026-55094 (GCVE-0-2026-55094)
Vulnerability from cvelistv5
Published
2026-09-30 17:22
Modified
2026-09-30 19:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
- CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
- CWE-250 - Execution with Unnecessary Privileges
- CWE-306 - Missing Authentication for Critical Function
Summary
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| taskcluster | taskcluster |
Version: < 100.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55094",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:12:04.595464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T19:12:22.456Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "taskcluster",
"vendor": "taskcluster",
"versions": [
{
"status": "affected",
"version": "\u003c 100.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Taskcluster is the task execution framework that supports Mozilla\u0027s continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250: Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:22:52.135Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38"
},
{
"name": "https://github.com/taskcluster/taskcluster/issues/8716",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/taskcluster/taskcluster/issues/8716"
},
{
"name": "https://github.com/taskcluster/taskcluster/pull/8718",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/taskcluster/taskcluster/pull/8718"
},
{
"name": "https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b"
},
{
"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045091",
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045091"
},
{
"name": "https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0"
}
],
"source": {
"advisory": "GHSA-ccv5-c45x-2q38",
"discovery": "UNKNOWN"
},
"title": "Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55094",
"datePublished": "2026-09-30T17:22:52.135Z",
"dateReserved": "2026-06-16T14:41:54.578Z",
"dateUpdated": "2026-09-30T19:12:22.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55094\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-30T19:12:04.595464Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-30T19:12:15.308Z\"}}], \"cna\": {\"title\": \"Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)\", \"source\": {\"advisory\": \"GHSA-ccv5-c45x-2q38\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"taskcluster\", \"product\": \"taskcluster\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 100.3.0\"}]}], \"references\": [{\"url\": \"https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38\", \"name\": \"https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/taskcluster/taskcluster/issues/8716\", \"name\": \"https://github.com/taskcluster/taskcluster/issues/8716\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/taskcluster/taskcluster/pull/8718\", \"name\": \"https://github.com/taskcluster/taskcluster/pull/8718\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b\", \"name\": \"https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=2045091\", \"name\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=2045091\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0\", \"name\": \"https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Taskcluster is the task execution framework that supports Mozilla\u0027s continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-95\", \"description\": \"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-250\", \"description\": \"CWE-250: Execution with Unnecessary Privileges\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306: Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-30T17:22:52.135Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-55094\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-30T19:12:22.456Z\", \"dateReserved\": \"2026-06-16T14:41:54.578Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-30T17:22:52.135Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…