Common Weakness Enumeration
CWE-636
Allowed-with-ReviewNot Failing Securely ('Failing Open')
Abstraction: Class · Status: Draft
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
117 vulnerabilities reference this CWE, most recent first.
CVE-2026-100860 (GCVE-0-2026-100860)
Vulnerability from cvelistv5 – Published: 2026-09-27 01:28 – Updated: 2026-09-28 16:05
VLAI
EPSS
VEX
Title
heym before 0.0.105 Authentication Bypass via Redis Node
Summary
heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). When _get_accessible_credential returns None — because the credential ID does not exist or the caller is not authorized to use it — the node treats the lookup failure as an empty configuration and falls back to defaults, connecting to localhost:6379 with no password and executing the requested operation there. The same fallback occurs when an accessible credential has an empty config or no redis_host value. An authenticated workflow author who supplies a credential ID they do not own, or one that was deleted, therefore obtains a read/write connection to whatever Redis is listening on the backend's loopback interface instead of an error. Impact depends on the deployment: the stock docker-compose.yml ships no Redis, in which case the flaw surfaces as a misleading connection error rather than data exposure.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 16:04 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/heymrun/heym/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/heym-before-… | third-party-advisory |
Impacted products
Date Public
2026-09-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100860",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T16:04:55.751279Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:05:18.442Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heymrun/heym/security/advisories/GHSA-fmpw-hj3m-xvj6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "heym",
"vendor": "heymrun",
"versions": [
{
"lessThan": "0.0.105",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.0.105",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fatihkaratash"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). When _get_accessible_credential returns None \u2014 because the credential ID does not exist or the caller is not authorized to use it \u2014 the node treats the lookup failure as an empty configuration and falls back to defaults, connecting to localhost:6379 with no password and executing the requested operation there. The same fallback occurs when an accessible credential has an empty config or no redis_host value. An authenticated workflow author who supplies a credential ID they do not own, or one that was deleted, therefore obtains a read/write connection to whatever Redis is listening on the backend\u0027s loopback interface instead of an error. Impact depends on the deployment: the stock docker-compose.yml ships no Redis, in which case the flaw surfaces as a misleading connection error rather than data exposure."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-27T01:28:50.589Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fmpw-hj3m-xvj6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/heymrun/heym/security/advisories/GHSA-fmpw-hj3m-xvj6"
},
{
"name": "VulnCheck Advisory: heym before 0.0.105 Authentication Bypass via Redis Node",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/heym-before-0.0.105-authentication-bypass-via-redis-node"
}
],
"title": "heym before 0.0.105 Authentication Bypass via Redis Node",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-100860",
"datePublished": "2026-09-27T01:28:50.589Z",
"dateReserved": "2026-09-27T00:20:03.854Z",
"dateUpdated": "2026-09-28T16:05:18.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100304 (GCVE-0-2026-100304)
Vulnerability from cvelistv5 – Published: 2026-09-25 18:47 – Updated: 2026-09-29 17:51
VLAI
EPSS
VEX
Title
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
Summary
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 17:49 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/LinYuanyi1/cve-request-poc/blo… | exploit |
| https://github.com/TDuckCloud/tduck-survey-form | product |
| https://github.com/TDuckCloud/tduck-survey-form/b… | technical-description |
| https://github.com/TDuckCloud/tduck-survey-form/b… | technical-description |
| https://github.com/TDuckCloud/tduck-survey-form/b… | technical-description |
| https://www.vulncheck.com/advisories/tduck-survey… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TDuckCloud | tduck-survey-form |
Affected:
6.0
(custom)
|
Date Public
2026-09-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100304",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T17:49:17.063623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:51:07.650Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/TDuckCloud/tduck-survey-form",
"defaultStatus": "unaffected",
"product": "tduck-survey-form",
"repo": "https://github.com/TDuckCloud/tduck-survey-form",
"vendor": "TDuckCloud",
"versions": [
{
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yaqi Chao"
},
{
"lang": "en",
"type": "finder",
"value": "Mingsheng Lin"
}
],
"datePublic": "2026-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T18:47:39.440Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_details_orphan.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/TDuckCloud/tduck-survey-form"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-form/src/main/java/com/tduck/cloud/form/util/FormAuthUtils.java#L25-L39"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java#L169-L187"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java#L451-L459"
},
{
"name": "VulnCheck Advisory: TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tduck-survey-form-6.0-information-disclosure-via-fail-open-form-ownership-check"
}
],
"title": "TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-100304",
"datePublished": "2026-09-25T18:47:39.440Z",
"dateReserved": "2026-09-25T18:18:53.644Z",
"dateUpdated": "2026-09-29T17:51:07.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95848 (GCVE-0-2026-95848)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 17:58
VLAI
EPSS
VEX
Title
Moquette fails open when configured authentication or authorization classes cannot load
Summary
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 17:58 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/moquette-io/moquette/security/… | x_refsource_CONFIRM |
| https://github.com/moquette-io/moquette/pull/967 | x_refsource_MISC |
| https://github.com/moquette-io/moquette/commit/14… | x_refsource_MISC |
| https://github.com/moquette-io/moquette/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| moquette-io | moquette |
Affected:
< 0.18.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95848",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T17:58:35.511233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T17:58:59.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "moquette",
"vendor": "moquette-io",
"versions": [
{
"status": "affected",
"version": "\u003c 0.18.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:29:58.300Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
},
{
"name": "https://github.com/moquette-io/moquette/pull/967",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/pull/967"
},
{
"name": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007"
},
{
"name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
}
],
"source": {
"advisory": "GHSA-h285-r7h3-gfjg",
"discovery": "UNKNOWN"
},
"title": "Moquette fails open when configured authentication or authorization classes cannot load"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-95848",
"datePublished": "2026-09-23T16:29:58.300Z",
"dateReserved": "2026-09-22T16:39:45.794Z",
"dateUpdated": "2026-09-23T17:58:59.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95676 (GCVE-0-2026-95676)
Vulnerability from cvelistv5 – Published: 2026-09-23 12:52 – Updated: 2026-09-23 15:24
VLAI
EPSS
VEX
Title
AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass
Summary
A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:24 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.watchguard.com/CVE-2026-95676 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WatchGuard | AuthPoint Authentication Gateway |
Affected:
4.2.2 , < 7.5.1
(semver)
cpe:2.3:a:watchguard:authpoint_authentication_gateway:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:24:44.392517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:24:54.616Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AuthPoint Authentication Gateway",
"vendor": "WatchGuard",
"versions": [
{
"lessThan": "7.5.1",
"status": "affected",
"version": "4.2.2",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis vulnerability affects deployments that are configured to sync AuthPoint users from an LDAP source.\u003c/p\u003e"
}
],
"value": "This vulnerability affects deployments that are configured to sync AuthPoint users from an LDAP source."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:watchguard:authpoint_authentication_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.5.1",
"versionStartIncluding": "4.2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Discovered internally by WatchGuard"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway\u0027s LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-636",
"description": "CWE-636",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T12:52:04.902Z",
"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"shortName": "WatchGuard"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.watchguard.com/CVE-2026-95676"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "AuthPoint Authentication Gateway 7.5.1"
}
],
"value": "AuthPoint Authentication Gateway 7.5.1"
}
],
"title": "AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"assignerShortName": "WatchGuard",
"cveId": "CVE-2026-95676",
"datePublished": "2026-09-23T12:52:04.902Z",
"dateReserved": "2026-09-22T13:47:30.359Z",
"dateUpdated": "2026-09-23T15:24:54.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92591 (GCVE-0-2026-92591)
Vulnerability from cvelistv5 – Published: 2026-09-16 21:46 – Updated: 2026-09-17 13:26
VLAI
EPSS
VEX
Title
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
Summary
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does not. The action accepts a site name, serializes it through Site::getName(), and expands ${NAME} expressions using App::env(). An unauthenticated attacker who obtained a guest session cookie and matching CSRF token before the outage and whose session remains valid during it can submit a predictable variable name (for example Craft's conventional CRAFT_SECURITY_KEY) and receive its value, disclosing Craft secrets, process environment variables, $_SERVER entries, or PHP constants such as the security key, database credentials, or API keys. The issue requires an independently occurring database outage; the vulnerability itself provides no way to induce it. Fixed in 5.10.13.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 13:24 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/craftcms/cms/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/craft-cms-5.… | third-party-advisory |
Impacted products
Date Public
2026-09-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T13:24:05.702594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:26:27.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.10.13",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.13",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.13",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Crypto-Cat"
}
],
"datePublic": "2026-09-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions \u2014 including install/validate-site \u2014 reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does not. The action accepts a site name, serializes it through Site::getName(), and expands ${NAME} expressions using App::env(). An unauthenticated attacker who obtained a guest session cookie and matching CSRF token before the outage and whose session remains valid during it can submit a predictable variable name (for example Craft\u0027s conventional CRAFT_SECURITY_KEY) and receive its value, disclosing Craft secrets, process environment variables, $_SERVER entries, or PHP constants such as the security key, database credentials, or API keys. The issue requires an independently occurring database outage; the vulnerability itself provides no way to induce it. Fixed in 5.10.13."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T21:46:57.263Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hfjh-gw6x-7pv5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-hfjh-gw6x-7pv5"
},
{
"name": "VulnCheck Advisory: Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.13-environment-secret-exposure-via-installer"
}
],
"title": "Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92591",
"datePublished": "2026-09-16T21:46:57.263Z",
"dateReserved": "2026-09-16T13:47:49.170Z",
"dateUpdated": "2026-09-17T13:26:27.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88831 (GCVE-0-2026-88831)
Vulnerability from cvelistv5 – Published: 2026-09-23 17:45 – Updated: 2026-09-25 22:28
VLAI
EPSS
VEX
Title
Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
Summary
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:08 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:72111 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-88831 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2531346 | issue-trackingx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.37.0-9.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
Date Public
2026-09-23 16:35
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:08:33.797869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:11:48.288Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "busybox-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.37.0-9.1.hum1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."
}
],
"datePublic": "2026-09-23T16:35:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T22:28:19.246Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:72111",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:72111"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-88831"
},
{
"name": "RHBZ#2531346",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531346"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-09T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-09-23T16:35:00.000Z",
"value": "Made public."
}
],
"title": "Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths",
"workarounds": [
{
"lang": "en",
"value": "Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls (iptables/nftables) as the primary enforcement layer rather than relying on application-level ACLs."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-88831",
"datePublished": "2026-09-23T17:45:23.299Z",
"dateReserved": "2026-09-10T09:42:04.559Z",
"dateUpdated": "2026-09-25T22:28:19.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86120 (GCVE-0-2026-86120)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
Summary
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:10 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apitable/apitable/issues/1814 | issue-tracking |
| https://github.com/apitable/apitable/blob/88b24ce… | technical-description |
| https://github.com/apitable/apitable | product |
| https://www.vulncheck.com/advisories/apitable-thr… | third-party-advisory |
Impacted products
Date Public
2026-07-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:10:53.124006Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:11:05.778Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/apitable/apitable",
"product": "apitable",
"repo": "https://github.com/apitable/apitable",
"vendor": "apitable",
"versions": [
{
"lessThanOrEqual": "1.13.0-beta.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:07.196Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1814",
"tags": [
"issue-tracking"
],
"url": "https://github.com/apitable/apitable/issues/1814"
},
{
"name": "NodePermissionGuard.matchPermissions empty catch",
"tags": [
"technical-description"
],
"url": "https://github.com/apitable/apitable/blob/88b24ce9f359/packages/room-server/src/fusion/middleware/guard/node.permission.guard.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/apitable/apitable"
},
{
"name": "VulnCheck Advisory: APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-fail-open-authorization-in-the-fusion-api-node-permission-guard"
}
],
"title": "APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86120",
"datePublished": "2026-09-05T09:59:09.419Z",
"dateReserved": "2026-09-05T01:59:22.436Z",
"dateUpdated": "2026-09-24T14:21:07.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85649 (GCVE-0-2026-85649)
Vulnerability from cvelistv5 – Published: 2026-09-04 12:59 – Updated: 2026-09-04 17:59
VLAI
EPSS
VEX
Summary
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:59 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ChewKeanHo/software-actualizer… | release-notespatch |
| https://github.com/ChewKeanHo/software-actualizer… | patch |
| https://github.com/ChewKeanHo/software-actualizer… | |
| https://doi.org/10.5281/zenodo.22169659 | technical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chewkeanho | software-actualizer |
Affected:
0 , ≤ 1.2.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85649",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:59:16.199359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:59:26.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "software-actualizer",
"vendor": "chewkeanho",
"versions": [
{
"lessThanOrEqual": "1.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Alice Xiang Yu Xuan (\u6e58\u6e1d\u8431)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "(Holloway) Chew, Kean Ho"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e(Holloway) Chew, Kean Ho\u0027s Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command\u0027s return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.\u003c/p\u003e"
}
],
"value": "(Holloway) Chew, Kean Ho\u0027s Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command\u0027s return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636: Not Failing Securely (Failing Open)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-252",
"description": "CWE-252: Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T12:59:59.743Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/ChewKeanHo/software-actualizer/releases/tag/v1.2.1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ChewKeanHo/software-actualizer/commit/50a0932ac705635d9af62955c353e7c6df003a61.patch"
},
{
"url": "https://github.com/ChewKeanHo/software-actualizer/blob/v1.2.0/Shell/debian-minbase-install.sh#L788"
},
{
"tags": [
"technical-description"
],
"url": "https://doi.org/10.5281/zenodo.22169659"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Actualizer v1.2.1 or later. The fixed version validates that the generated password hash has the expected yescrypt prefix and performs a pre-flight check for yescrypt support before building.\u003c/p\u003e"
}
],
"value": "Upgrade to Actualizer v1.2.1 or later. The fixed version validates that the generated password hash has the expected yescrypt prefix and performs a pre-flight check for yescrypt support before building."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-85649",
"datePublished": "2026-09-04T12:59:59.743Z",
"dateReserved": "2026-09-04T12:58:10.268Z",
"dateUpdated": "2026-09-04T17:59:26.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82744 (GCVE-0-2026-82744)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:39 – Updated: 2026-09-01 15:15
VLAI
EPSS
VEX
Title
Ash.Reactor change step fails open, skipping a change when its where guard raises
Summary
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not.
An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed.
This issue affects ash: from 3.0.0-rc.17 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:15 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82744.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82744 | related |
| https://github.com/ash-project/ash/commit/6d2eb86… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.0.0-rc.17 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
321f43bd05ad9544e693cbf797243693e51a6be4 , < 6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82744",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:15:37.062501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:15:56.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Reactor.ChangeStep\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/reactor/steps/change_step.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Reactor.ChangeStep\u0027:apply_where_clauses/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.0.0-rc.17",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Reactor.ChangeStep\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/reactor/steps/change_step.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Reactor.ChangeStep\u0027:apply_where_clauses/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc",
"status": "affected",
"version": "321f43bd05ad9544e693cbf797243693e51a6be4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.0.0-rc.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNot Failing Securely (Failing Open) vulnerability in ash-project ash skips an \u003ccode\u003eAsh.Reactor\u003c/code\u003e change when the guard controlling it raises, so a change meant to run does not.\u003c/p\u003e\n\u003cp\u003eAn \u003ccode\u003eAsh.Reactor\u003c/code\u003e \u003ccode\u003echange\u003c/code\u003e step can be gated by \u003ccode\u003ewhere\u003c/code\u003e validations that decide whether the change runs. \u003ccode\u003eAsh.Reactor.ChangeStep\u003c/code\u003e (\u003ccode\u003elib/ash/reactor/steps/change_step.ex\u003c/code\u003e) evaluated those guards in \u003ccode\u003eapply_where_clauses/3\u003c/code\u003e, and \u003ccode\u003eapply_validation\u003c/code\u003e rescued any exception into \u003ccode\u003e{:error, error}\u003c/code\u003e. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now \u003ccode\u003e{:raised, error}\u003c/code\u003e) and halts the step with an error, failing closed.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.0.0-rc.17 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an `Ash.Reactor` change when the guard controlling it raises, so a change meant to run does not.\n\nAn `Ash.Reactor` `change` step can be gated by `where` validations that decide whether the change runs. `Ash.Reactor.ChangeStep` (`lib/ash/reactor/steps/change_step.ex`) evaluated those guards in `apply_where_clauses/3`, and `apply_validation` rescued any exception into `{:error, error}`. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now `{:raised, error}`) and halts the step with an error, failing closed.\n\nThis issue affects ash: from 3.0.0-rc.17 before 3.32.2."
}
],
"value": "Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not.\n\nAn Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed.\n\nThis issue affects ash: from 3.0.0-rc.17 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636 Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:39:42.668Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82744.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82744"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Reactor change step fails open, skipping a change when its where guard raises"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82744",
"datePublished": "2026-09-01T03:39:42.668Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:15:56.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82018 (GCVE-0-2026-82018)
Vulnerability from cvelistv5 – Published: 2026-08-28 21:11 – Updated: 2026-10-01 15:21
VLAI
EPSS
VEX
Title
IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File
Summary
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:46 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://kb.igel.com/en/security-safety/current/is… | vendor-advisorypatch |
| https://blog.amberwolf.com/blog/2026/august/thin-… | technical-description |
| https://media.defcon.org/DEF%20CON%2034/DEF%20CON… | |
| https://www.vulncheck.com/advisories/igel-os-12-1… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IGEL | IGEL OS 12 |
Affected:
12.0.0 , ≤ 12.8.2
(semver)
Unaffected: 12.8.3 (semver) Unaffected: 12.9.0 (semver) |
|
| IGEL | IGEL OS 11 |
Affected:
11.0.0 , < 11.11.150
(semver)
|
Date Public
2026-06-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T18:46:35.490048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T18:46:41.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "IGEL OS 12",
"vendor": "IGEL",
"versions": [
{
"lessThanOrEqual": "12.8.2",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "12.8.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "12.9.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "IGEL OS 11",
"vendor": "IGEL",
"versions": [
{
"lessThan": "11.11.150",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:igel:igel_os:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.8.2",
"versionStartIncluding": "12.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:igel:igel_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.11.150",
"versionStartIncluding": "11.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Darren McDonald from AmberWolf"
}
],
"datePublic": "2026-06-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB\u0027s fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device\u0027s own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:21:40.808Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Vendor Advisory",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://kb.igel.com/en/security-safety/current/isn-2026-20-grub-shell-escape-in-igel-os"
},
{
"name": "AmberWolf Blog",
"tags": [
"technical-description"
],
"url": "https://blog.amberwolf.com/blog/2026/august/thin-client-thin-crypto-overview/"
},
{
"name": "DEF CON 34 Presentation",
"url": "https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Darren%20McDonald%20-%20Thin%20Client%20Thin%20Crypto%20-%20Bypassing%20Full-Desk%20Encryption%20Across%20Three%20Major%20Thin%20Clients%20Vendors%20without%20Breaking%20a%20Ci.pdf"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/igel-os-12-11-secure-boot-bypass-via-unsigned-igel-conf-file"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82018",
"datePublished": "2026-08-28T21:11:24.911Z",
"dateReserved": "2026-08-27T21:39:20.459Z",
"dateUpdated": "2026-10-01T15:21:40.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.
No CAPEC attack patterns related to this CWE.