https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:27:17 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338173 EUVD-2026-338173 https://cve.radiocsirt.org/vuln/euvd-2026-338173 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12112 <p>A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.</p> <p>A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12112 https://cve.radiocsirt.org/vuln/ghsa-6v32-2jc8-w595 <p>A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.</p> <p>A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.</p> https://cve.radiocsirt.org/vuln/ghsa-6v32-2jc8-w595 https://cve.radiocsirt.org/vuln/rhsa-2026:28405 <p>Authlib: Authlib: Cross-Site Request Forgery due to improper session management in state storage foreman-mcp-server: MCP Server: Insecure Sensitive HTTP Header Sanitization foreman-mcp-server: MCP Server: Active Session Hijacking via Insecure Session State Reuse</p> <p>Authlib: Authlib: Cross-Site Request Forgery due to improper session management in state storage foreman-mcp-server: MCP Server: Insecure Sensitive HTTP Header Sanitization foreman-mcp-server: MCP Server: Active Session Hijacking via Insecure Session State Reuse</p> https://cve.radiocsirt.org/vuln/rhsa-2026:28405