https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T16:58:18.902715+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337129 EUVD-2026-337129 2026-10-09T16:58:18.906649+00:00 EUVD-2026-337129 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23685 fkie_cve-2024-23685 2026-10-09T16:58:18.906700+00:00

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.

 https://cve.radiocsirt.org/vuln/ghsa-m8v7-469p-5x89 GHSA-m8v7-469p-5x89 — Hard-coded System User Credentials in Folio Data Export Spring module 2026-10-09T16:58:18.906758+00:00

Affected: Maven: org.folio:mod-remote-storage

### Impact The module creates a system user that is used to perform internal module-to-module operations. Credentials for this user are hard-coded in the source code. This makes it trivial to authenticate as this user, allowing unauthorized read access to these mod-inventory-storage records: instances, holdings, items, contributor-types, identifier-types. This includes records marked as suppressed from discovery.

### Patches Upgrade mod-remote-storage to >=2.0.3, or a 1.7.x version >=1.7.1.

### Workarounds No known workarounds.

### References https://wiki.folio.org/x/hbMMBw - FOLIO Security Advisory with Upgrade Instructions https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - Fix

 https://cve.radiocsirt.org/vuln/gsd-2024-23685 gsd-2024-23685 2026-10-09T16:58:18.906833+00:00 gsd-2024-23685