https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T18:00:56.554375+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2023-65127 cnvd-2023-65127 2026-10-10T18:00:56.557519+00:00 cnvd-2023-65127 https://cve.radiocsirt.org/vuln/euvd-2026-207057 EUVD-2026-207057 2026-10-10T18:00:56.557551+00:00 EUVD-2026-207057 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37265 fkie_cve-2023-37265 2026-10-10T18:00:56.557566+00:00

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

 https://cve.radiocsirt.org/vuln/ghsa-vjh7-5r6x-xh6g GHSA-vjh7-5r6x-xh6g — CasaOS Gateway vulnerable to incorrect identification of source IP addresses 2026-10-10T18:00:56.557596+00:00

Affected: Go: github.com/IceWhaleTech/CasaOS-Gateway

### Impact

Unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances.

### Patches

The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS 0.4.4.

### Workarounds

Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

### References

- 391dd7f - https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos/

 https://cve.radiocsirt.org/vuln/gsd-2023-37265 gsd-2023-37265 2026-10-10T18:00:56.557628+00:00 gsd-2023-37265