https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T14:50:36.324329+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-07086 bdu:2023-07086 2026-10-10T14:50:36.330198+00:00 bdu:2023-07086 https://cve.radiocsirt.org/vuln/cnvd-2023-65128 cnvd-2023-65128 2026-10-10T14:50:36.330234+00:00 cnvd-2023-65128 https://cve.radiocsirt.org/vuln/euvd-2026-207058 EUVD-2026-207058 2026-10-10T14:50:36.330249+00:00 EUVD-2026-207058 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37266 fkie_cve-2023-37266 2026-10-10T14:50:36.330260+00:00

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

 https://cve.radiocsirt.org/vuln/ghsa-m5q5-8mfw-p2hr GHSA-m5q5-8mfw-p2hr — CasaOS contains weak JWT secrets 2026-10-10T14:50:36.330291+00:00

Affected: Go: github.com/IceWhaleTech/CasaOS

### Impact

Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances.

### Patches

The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4.

### Workarounds

Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

### References

- 705bf1f - https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos/

 https://cve.radiocsirt.org/vuln/gsd-2023-37266 gsd-2023-37266 2026-10-10T14:50:36.330322+00:00 gsd-2023-37266