https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:11:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318024 EUVD-2026-318024 https://cve.radiocsirt.org/vuln/euvd-2026-318024 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42300 <p>DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user&#39;s Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation&#39;s DevGuard resources. This vulnerability is fixed in 1.2.2.</p> <p>DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user&#39;s Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation&#39;s DevGuard resources. This vulnerability is fixed in 1.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42300 https://cve.radiocsirt.org/vuln/ghsa-2g9v-7mr5-fgjg <p><strong>Affected:</strong> Go: github.com/l3montree-dev/devguard</p> <p>### Impact The `SessionMiddleware` accepts a client-supplied `X-Admin-Token` HTTP request header and uses its raw string value as the authenticated `userID` when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user&#39;s Kratos identity UUID can issue requests as that user. Where the target user is an organisation `admin` or `owner`, this gives the attacker full control over that organisation&#39;s DevGuard resources.</p> <p>### Patches The release v1.2.2 patches this issue. Update your DevGuard API Instances to this version.</p> <p>### Workarounds Configure a reverse proxy to strip the `X-Admin-Token` header before sending requests to the DevGuard API.</p> <p>### Resources Fixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a</p> <p><strong>Affected:</strong> Go: github.com/l3montree-dev/devguard</p> <p>### Impact The `SessionMiddleware` accepts a client-supplied `X-Admin-Token` HTTP request header and uses its raw string value as the authenticated `userID` when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user&#39;s Kratos identity UUID can issue requests as that user. Where the target user is an organisation `admin` or `owner`, this gives the attacker full control over that organisation&#39;s DevGuard resources.</p> <p>### Patches The release v1.2.2 patches this issue. Update your DevGuard API Instances to this version.</p> <p>### Workarounds Configure a reverse proxy to strip the `X-Admin-Token` header before sending requests to the DevGuard API.</p> <p>### Resources Fixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a</p> https://cve.radiocsirt.org/vuln/ghsa-2g9v-7mr5-fgjg