Common Weakness Enumeration
CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
310 vulnerabilities reference this CWE, most recent first.
CVE-2026-6266 (GCVE-0-2026-6266)
Vulnerability from cvelistv5 – Published: 2026-05-04 13:47 – Updated: 2026-08-27 12:04
VLAI
EPSS
VEX
Title
Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking
Summary
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Severity
8.3 (High)
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-04 00:00 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:13508 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:13512 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:13545 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-6266 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2458142 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
|
Affected:
2.5.0 , < 2.5.20260422
(semver)
Affected: 2.6.0 , < 2.6.20260422 (semver) |
|||
|
Affected:
4.6.0 , < 4.6.28
(semver)
Affected: 4.7.0 , < 4.7.11 (semver) |
|||
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:4.6.28-3.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:2.5.20260422-2.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:4.6.28-3.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:2.5.20260422-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:4.7.11-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el10 cpe:/a:redhat:ansible_automation_platform:2.6::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:2.6.20260422-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el10 cpe:/a:redhat:ansible_automation_platform:2.6::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777377014 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777311120 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:4.6.28-3.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:2.5.20260422-2.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:4.6.28-3.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:2.5.20260422-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:4.7.11-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:2.6.20260422-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
Date Public
2026-05-04 13:35
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6266",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T03:56:19.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.28-3.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "python3.12-django-ansible-base",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.28-3.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-django-ansible-base",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.7.11-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.20260422-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-django-ansible-base",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.20260422-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777377014",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/gateway-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777311120",
"versionType": "rpm"
}
]
}
],
"datePublic": "2026-05-04T13:35:24.113Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim\u0027s account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:04:40.119Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-6266"
},
{
"name": "RHBZ#2458142",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458142"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6266.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-14T06:29:16.779Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-04T13:35:24.113Z",
"value": "Made public."
}
],
"title": "aap-controller: aap-gateway: Account hijacking and unauthorized access via unverified email linking",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ansible/django-ansible-base",
"defaultStatus": "unaffected",
"packageName": "django-ansible-base",
"versions": [
{
"lessThan": "2.5.20260422",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThan": "2.6.20260422",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser",
"defaultStatus": "unaffected",
"packageName": "automation-controller",
"versions": [
{
"lessThan": "4.6.28",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"lessThan": "4.7.11",
"status": "affected",
"version": "4.7.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser",
"defaultStatus": "unaffected",
"packageName": "automation-gateway",
"versions": [
{
"lessThan": "2.5.20260422",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThan": "2.6.20260422",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.28-3.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-django-ansible-base",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.28-3.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-django-ansible-base",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260422-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.7.11-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.20260422-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-django-ansible-base",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.20260422-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777377014",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/gateway-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777311120",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Robin Bobbitt (Red Hat)."
}
],
"datePublic": "2026-05-04T13:35:24.113Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim\u0027s account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T15:46:08.687Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:13508",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"name": "RHSA-2026:13512",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"name": "RHSA-2026:13545",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-6266"
},
{
"name": "RHBZ#2458142",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458142"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-14T06:29:16.779Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-04T13:35:24.113Z",
"value": "Made public."
}
],
"title": "Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-305: Authentication Bypass by Primary Weakness"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-6266",
"datePublished": "2026-05-04T13:47:07.260Z",
"dateReserved": "2026-04-14T06:33:59.504Z",
"dateUpdated": "2026-08-27T12:04:40.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5545 (GCVE-0-2026-5545)
Vulnerability from cvelistv5 – Published: 2026-05-13 08:27 – Updated: 2026-09-15 06:02
VLAI
EPSS
VEX
Title
wrong reuse of HTTP Negotiate connection
Summary
libcurl might in some circumstances reuse the wrong connection when asked to
do an authenticated HTTP(S) request after a Negotiate-authenticated one, when
both use the same host.
libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different credentials.
An application that first uses Negotiate authentication to a server with
`user1:password1` and then does another operation to the same server asking
for any authentication method but for `user2:password2` (while the previous
connection is still alive) - the second request gets confused and wrongly
reuses the same connection and sends the new request over that connection
thinking it uses a mix of user1's and user2's credentials when it is in fact
still using the connection authenticated for user1...
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 17:46 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl |
Affected:
7.10.6 , < 8.14.2
(semver)
Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver) |
|
| curl | curl |
Affected:
e56ae1426cb7a0a4a427cf8d6099a821fdaae428 , < 33e43985b8f3b9e66691d06e70be0395849856cd
(git)
|
|
| curl | curl |
Affected:
8.19.0
Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0 Affected: 7.13.2 Affected: 7.13.1 Affected: 7.13.0 Affected: 7.12.3 Affected: 7.12.2 Affected: 7.12.1 Affected: 7.12.0 Affected: 7.11.2 Affected: 7.11.1 Affected: 7.11.0 Affected: 7.10.8 Affected: 7.10.7 Affected: 7.10.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-5545",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T17:46:36.115262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T17:46:40.830Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackerone.com/reports/3642555"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThan": "8.14.2",
"status": "affected",
"version": "7.10.6",
"versionType": "semver"
},
{
"lessThan": "8.16.1",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThan": "8.20.0",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"versions": [
{
"lessThan": "33e43985b8f3b9e66691d06e70be0395849856cd",
"status": "affected",
"version": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"status": "affected",
"version": "8.19.0"
},
{
"status": "affected",
"version": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0"
},
{
"status": "affected",
"version": "8.11.1"
},
{
"status": "affected",
"version": "8.11.0"
},
{
"status": "affected",
"version": "8.10.1"
},
{
"status": "affected",
"version": "8.10.0"
},
{
"status": "affected",
"version": "8.9.1"
},
{
"status": "affected",
"version": "8.9.0"
},
{
"status": "affected",
"version": "8.8.0"
},
{
"status": "affected",
"version": "8.7.1"
},
{
"status": "affected",
"version": "8.7.0"
},
{
"status": "affected",
"version": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0"
},
{
"status": "affected",
"version": "8.4.0"
},
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.2.1"
},
{
"status": "affected",
"version": "8.2.0"
},
{
"status": "affected",
"version": "8.1.2"
},
{
"status": "affected",
"version": "8.1.1"
},
{
"status": "affected",
"version": "8.1.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "7.88.1"
},
{
"status": "affected",
"version": "7.88.0"
},
{
"status": "affected",
"version": "7.87.0"
},
{
"status": "affected",
"version": "7.86.0"
},
{
"status": "affected",
"version": "7.85.0"
},
{
"status": "affected",
"version": "7.84.0"
},
{
"status": "affected",
"version": "7.83.1"
},
{
"status": "affected",
"version": "7.83.0"
},
{
"status": "affected",
"version": "7.82.0"
},
{
"status": "affected",
"version": "7.81.0"
},
{
"status": "affected",
"version": "7.80.0"
},
{
"status": "affected",
"version": "7.79.1"
},
{
"status": "affected",
"version": "7.79.0"
},
{
"status": "affected",
"version": "7.78.0"
},
{
"status": "affected",
"version": "7.77.0"
},
{
"status": "affected",
"version": "7.76.1"
},
{
"status": "affected",
"version": "7.76.0"
},
{
"status": "affected",
"version": "7.75.0"
},
{
"status": "affected",
"version": "7.74.0"
},
{
"status": "affected",
"version": "7.73.0"
},
{
"status": "affected",
"version": "7.72.0"
},
{
"status": "affected",
"version": "7.71.1"
},
{
"status": "affected",
"version": "7.71.0"
},
{
"status": "affected",
"version": "7.70.0"
},
{
"status": "affected",
"version": "7.69.1"
},
{
"status": "affected",
"version": "7.69.0"
},
{
"status": "affected",
"version": "7.68.0"
},
{
"status": "affected",
"version": "7.67.0"
},
{
"status": "affected",
"version": "7.66.0"
},
{
"status": "affected",
"version": "7.65.3"
},
{
"status": "affected",
"version": "7.65.2"
},
{
"status": "affected",
"version": "7.65.1"
},
{
"status": "affected",
"version": "7.65.0"
},
{
"status": "affected",
"version": "7.64.1"
},
{
"status": "affected",
"version": "7.64.0"
},
{
"status": "affected",
"version": "7.63.0"
},
{
"status": "affected",
"version": "7.62.0"
},
{
"status": "affected",
"version": "7.61.1"
},
{
"status": "affected",
"version": "7.61.0"
},
{
"status": "affected",
"version": "7.60.0"
},
{
"status": "affected",
"version": "7.59.0"
},
{
"status": "affected",
"version": "7.58.0"
},
{
"status": "affected",
"version": "7.57.0"
},
{
"status": "affected",
"version": "7.56.1"
},
{
"status": "affected",
"version": "7.56.0"
},
{
"status": "affected",
"version": "7.55.1"
},
{
"status": "affected",
"version": "7.55.0"
},
{
"status": "affected",
"version": "7.54.1"
},
{
"status": "affected",
"version": "7.54.0"
},
{
"status": "affected",
"version": "7.53.1"
},
{
"status": "affected",
"version": "7.53.0"
},
{
"status": "affected",
"version": "7.52.1"
},
{
"status": "affected",
"version": "7.52.0"
},
{
"status": "affected",
"version": "7.51.0"
},
{
"status": "affected",
"version": "7.50.3"
},
{
"status": "affected",
"version": "7.50.2"
},
{
"status": "affected",
"version": "7.50.1"
},
{
"status": "affected",
"version": "7.50.0"
},
{
"status": "affected",
"version": "7.49.1"
},
{
"status": "affected",
"version": "7.49.0"
},
{
"status": "affected",
"version": "7.48.0"
},
{
"status": "affected",
"version": "7.47.1"
},
{
"status": "affected",
"version": "7.47.0"
},
{
"status": "affected",
"version": "7.46.0"
},
{
"status": "affected",
"version": "7.45.0"
},
{
"status": "affected",
"version": "7.44.0"
},
{
"status": "affected",
"version": "7.43.0"
},
{
"status": "affected",
"version": "7.42.1"
},
{
"status": "affected",
"version": "7.42.0"
},
{
"status": "affected",
"version": "7.41.0"
},
{
"status": "affected",
"version": "7.40.0"
},
{
"status": "affected",
"version": "7.39.0"
},
{
"status": "affected",
"version": "7.38.0"
},
{
"status": "affected",
"version": "7.37.1"
},
{
"status": "affected",
"version": "7.37.0"
},
{
"status": "affected",
"version": "7.36.0"
},
{
"status": "affected",
"version": "7.35.0"
},
{
"status": "affected",
"version": "7.34.0"
},
{
"status": "affected",
"version": "7.33.0"
},
{
"status": "affected",
"version": "7.32.0"
},
{
"status": "affected",
"version": "7.31.0"
},
{
"status": "affected",
"version": "7.30.0"
},
{
"status": "affected",
"version": "7.29.0"
},
{
"status": "affected",
"version": "7.28.1"
},
{
"status": "affected",
"version": "7.28.0"
},
{
"status": "affected",
"version": "7.27.0"
},
{
"status": "affected",
"version": "7.26.0"
},
{
"status": "affected",
"version": "7.25.0"
},
{
"status": "affected",
"version": "7.24.0"
},
{
"status": "affected",
"version": "7.23.1"
},
{
"status": "affected",
"version": "7.23.0"
},
{
"status": "affected",
"version": "7.22.0"
},
{
"status": "affected",
"version": "7.21.7"
},
{
"status": "affected",
"version": "7.21.6"
},
{
"status": "affected",
"version": "7.21.5"
},
{
"status": "affected",
"version": "7.21.4"
},
{
"status": "affected",
"version": "7.21.3"
},
{
"status": "affected",
"version": "7.21.2"
},
{
"status": "affected",
"version": "7.21.1"
},
{
"status": "affected",
"version": "7.21.0"
},
{
"status": "affected",
"version": "7.20.1"
},
{
"status": "affected",
"version": "7.20.0"
},
{
"status": "affected",
"version": "7.19.7"
},
{
"status": "affected",
"version": "7.19.6"
},
{
"status": "affected",
"version": "7.19.5"
},
{
"status": "affected",
"version": "7.19.4"
},
{
"status": "affected",
"version": "7.19.3"
},
{
"status": "affected",
"version": "7.19.2"
},
{
"status": "affected",
"version": "7.19.1"
},
{
"status": "affected",
"version": "7.19.0"
},
{
"status": "affected",
"version": "7.18.2"
},
{
"status": "affected",
"version": "7.18.1"
},
{
"status": "affected",
"version": "7.18.0"
},
{
"status": "affected",
"version": "7.17.1"
},
{
"status": "affected",
"version": "7.17.0"
},
{
"status": "affected",
"version": "7.16.4"
},
{
"status": "affected",
"version": "7.16.3"
},
{
"status": "affected",
"version": "7.16.2"
},
{
"status": "affected",
"version": "7.16.1"
},
{
"status": "affected",
"version": "7.16.0"
},
{
"status": "affected",
"version": "7.15.5"
},
{
"status": "affected",
"version": "7.15.4"
},
{
"status": "affected",
"version": "7.15.3"
},
{
"status": "affected",
"version": "7.15.2"
},
{
"status": "affected",
"version": "7.15.1"
},
{
"status": "affected",
"version": "7.15.0"
},
{
"status": "affected",
"version": "7.14.1"
},
{
"status": "affected",
"version": "7.14.0"
},
{
"status": "affected",
"version": "7.13.2"
},
{
"status": "affected",
"version": "7.13.1"
},
{
"status": "affected",
"version": "7.13.0"
},
{
"status": "affected",
"version": "7.12.3"
},
{
"status": "affected",
"version": "7.12.2"
},
{
"status": "affected",
"version": "7.12.1"
},
{
"status": "affected",
"version": "7.12.0"
},
{
"status": "affected",
"version": "7.11.2"
},
{
"status": "affected",
"version": "7.11.1"
},
{
"status": "affected",
"version": "7.11.0"
},
{
"status": "affected",
"version": "7.10.8"
},
{
"status": "affected",
"version": "7.10.7"
},
{
"status": "affected",
"version": "7.10.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Quac Tran and Ngoc Hieu"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Stefan Eissing"
}
],
"descriptions": [
{
"lang": "en",
"value": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\nstill using the connection authenticated for user1..."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T06:02:59.285Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"url": "https://curl.se/docs/CVE-2026-5545.json"
},
{
"url": "https://curl.se/docs/CVE-2026-5545.html"
},
{
"url": "https://hackerone.com/reports/3642555"
}
],
"title": "wrong reuse of HTTP Negotiate connection",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_osv": {
"affected": [
{
"ranges": [
{
"events": [
{
"introduced": "7.10.6"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.0"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428"
},
{
"fixed": "33e43985b8f3b9e66691d06e70be0395849856cd"
}
],
"repo": "https://github.com/curl/curl.git",
"type": "GIT"
}
],
"versions": [
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0",
"7.13.2",
"7.13.1",
"7.13.0",
"7.12.3",
"7.12.2",
"7.12.1",
"7.12.0",
"7.11.2",
"7.11.1",
"7.11.0",
"7.10.8",
"7.10.7",
"7.10.6"
]
}
],
"aliases": [
"CVE-2026-5545"
],
"credits": [
{
"name": "Quac Tran and Ngoc Hieu",
"type": "finder"
},
{
"name": "Stefan Eissing",
"type": "remediation developer"
}
],
"database_specific": {
"CWE": {
"desc": "Authentication Bypass by Primary Weakness",
"id": "CWE-305"
},
"URL": "https://curl.se/docs/CVE-2026-5545.json",
"affects": "both",
"issue": "https://hackerone.com/reports/3642555",
"last_affected": "8.19.0",
"package": "curl",
"severity": "Medium",
"www": "https://curl.se/docs/CVE-2026-5545.html"
},
"details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\nstill using the connection authenticated for user1...",
"id": "CURL-CVE-2026-5545",
"modified": "2026-09-07T10:34:51.00Z",
"published": "2026-04-29T08:00:00.00Z",
"schema_version": "1.5.0",
"summary": "wrong reuse of HTTP Negotiate connection"
}
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-5545",
"datePublished": "2026-05-13T08:27:26.065Z",
"dateReserved": "2026-04-04T12:10:07.125Z",
"dateUpdated": "2026-09-15T06:02:59.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4670 (GCVE-0-2026-4670)
Vulnerability from cvelistv5 – Published: 2026-04-30 15:06 – Updated: 2026-05-01 03:55
VLAI
EPSS
VEX
Title
Improper Authentication vulnerability in Progress MOVEit Automation
Summary
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.
This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-30 00:00 UTC
CWE
- CWE-305 - Authentication bypass by primary weakness
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/MOVEit-A… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | MOVEit Automation |
Affected:
2025.0.0 , < 2025.0.9
(semver)
Affected: 2024.0.0 , < 2024.1.8 (semver) Affected: 0 , < 2024.0.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T03:55:57.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MOVEit Automation",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2025.0.9",
"status": "affected",
"version": "2025.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.1.8",
"status": "affected",
"version": "2024.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Airbus SecLab"
},
{
"lang": "en",
"type": "finder",
"value": "Ana\u00efs Gantet"
},
{
"lang": "en",
"type": "finder",
"value": "Delphine Gourdou"
},
{
"lang": "en",
"type": "finder",
"value": "Quentin Liddell"
},
{
"lang": "en",
"type": "finder",
"value": "Matteo Ricordeau"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.\u003cp\u003eThis issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.\u003c/p\u003e"
}
],
"value": "Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.\n\nThis issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication bypass by primary weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T15:06:11.600Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Authentication vulnerability in Progress MOVEit Automation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-4670",
"datePublished": "2026-04-30T15:06:11.600Z",
"dateReserved": "2026-03-23T18:04:32.645Z",
"dateUpdated": "2026-05-01T03:55:57.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3784 (GCVE-0-2026-3784)
Vulnerability from cvelistv5 – Published: 2026-03-11 10:09 – Updated: 2026-09-15 06:02
VLAI
EPSS
VEX
Title
wrong proxy connection reuse with credentials
Summary
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP proxy.
The proper behavior is to create or use a separate connection.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-11 15:48 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl |
Affected:
7.7.0 , < 8.14.2
(semver)
Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.19.0 (semver) |
|
| curl | curl |
Affected:
a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4 , < 5f13a7645e565c5c1a06f3ef86e97afb856fb364
(git)
|
|
| curl | curl |
Affected:
8.18.0
Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0 Affected: 7.13.2 Affected: 7.13.1 Affected: 7.13.0 Affected: 7.12.3 Affected: 7.12.2 Affected: 7.12.1 Affected: 7.12.0 Affected: 7.11.2 Affected: 7.11.1 Affected: 7.11.0 Affected: 7.10.8 Affected: 7.10.7 Affected: 7.10.6 Affected: 7.10.5 Affected: 7.10.4 Affected: 7.10.3 Affected: 7.10.2 Affected: 7.10.1 Affected: 7.10 Affected: 7.9.8 Affected: 7.9.7 Affected: 7.9.6 Affected: 7.9.5 Affected: 7.9.4 Affected: 7.9.3 Affected: 7.9.2 Affected: 7.9.1 Affected: 7.9 Affected: 7.8.1 Affected: 7.8 Affected: 7.7.3 Affected: 7.7.2 Affected: 7.7.1 Affected: 7.7 |
|
| Siemens | RUGGEDCOM RST2428P |
Affected:
0 , < V4.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-03-11T10:16:32.844Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-3784",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-11T15:48:38.785522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T15:48:41.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T13:00:43.860Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThan": "8.14.2",
"status": "affected",
"version": "7.7.0",
"versionType": "semver"
},
{
"lessThan": "8.16.1",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThan": "8.19.0",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"versions": [
{
"lessThan": "5f13a7645e565c5c1a06f3ef86e97afb856fb364",
"status": "affected",
"version": "a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"status": "affected",
"version": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0"
},
{
"status": "affected",
"version": "8.11.1"
},
{
"status": "affected",
"version": "8.11.0"
},
{
"status": "affected",
"version": "8.10.1"
},
{
"status": "affected",
"version": "8.10.0"
},
{
"status": "affected",
"version": "8.9.1"
},
{
"status": "affected",
"version": "8.9.0"
},
{
"status": "affected",
"version": "8.8.0"
},
{
"status": "affected",
"version": "8.7.1"
},
{
"status": "affected",
"version": "8.7.0"
},
{
"status": "affected",
"version": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0"
},
{
"status": "affected",
"version": "8.4.0"
},
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.2.1"
},
{
"status": "affected",
"version": "8.2.0"
},
{
"status": "affected",
"version": "8.1.2"
},
{
"status": "affected",
"version": "8.1.1"
},
{
"status": "affected",
"version": "8.1.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "7.88.1"
},
{
"status": "affected",
"version": "7.88.0"
},
{
"status": "affected",
"version": "7.87.0"
},
{
"status": "affected",
"version": "7.86.0"
},
{
"status": "affected",
"version": "7.85.0"
},
{
"status": "affected",
"version": "7.84.0"
},
{
"status": "affected",
"version": "7.83.1"
},
{
"status": "affected",
"version": "7.83.0"
},
{
"status": "affected",
"version": "7.82.0"
},
{
"status": "affected",
"version": "7.81.0"
},
{
"status": "affected",
"version": "7.80.0"
},
{
"status": "affected",
"version": "7.79.1"
},
{
"status": "affected",
"version": "7.79.0"
},
{
"status": "affected",
"version": "7.78.0"
},
{
"status": "affected",
"version": "7.77.0"
},
{
"status": "affected",
"version": "7.76.1"
},
{
"status": "affected",
"version": "7.76.0"
},
{
"status": "affected",
"version": "7.75.0"
},
{
"status": "affected",
"version": "7.74.0"
},
{
"status": "affected",
"version": "7.73.0"
},
{
"status": "affected",
"version": "7.72.0"
},
{
"status": "affected",
"version": "7.71.1"
},
{
"status": "affected",
"version": "7.71.0"
},
{
"status": "affected",
"version": "7.70.0"
},
{
"status": "affected",
"version": "7.69.1"
},
{
"status": "affected",
"version": "7.69.0"
},
{
"status": "affected",
"version": "7.68.0"
},
{
"status": "affected",
"version": "7.67.0"
},
{
"status": "affected",
"version": "7.66.0"
},
{
"status": "affected",
"version": "7.65.3"
},
{
"status": "affected",
"version": "7.65.2"
},
{
"status": "affected",
"version": "7.65.1"
},
{
"status": "affected",
"version": "7.65.0"
},
{
"status": "affected",
"version": "7.64.1"
},
{
"status": "affected",
"version": "7.64.0"
},
{
"status": "affected",
"version": "7.63.0"
},
{
"status": "affected",
"version": "7.62.0"
},
{
"status": "affected",
"version": "7.61.1"
},
{
"status": "affected",
"version": "7.61.0"
},
{
"status": "affected",
"version": "7.60.0"
},
{
"status": "affected",
"version": "7.59.0"
},
{
"status": "affected",
"version": "7.58.0"
},
{
"status": "affected",
"version": "7.57.0"
},
{
"status": "affected",
"version": "7.56.1"
},
{
"status": "affected",
"version": "7.56.0"
},
{
"status": "affected",
"version": "7.55.1"
},
{
"status": "affected",
"version": "7.55.0"
},
{
"status": "affected",
"version": "7.54.1"
},
{
"status": "affected",
"version": "7.54.0"
},
{
"status": "affected",
"version": "7.53.1"
},
{
"status": "affected",
"version": "7.53.0"
},
{
"status": "affected",
"version": "7.52.1"
},
{
"status": "affected",
"version": "7.52.0"
},
{
"status": "affected",
"version": "7.51.0"
},
{
"status": "affected",
"version": "7.50.3"
},
{
"status": "affected",
"version": "7.50.2"
},
{
"status": "affected",
"version": "7.50.1"
},
{
"status": "affected",
"version": "7.50.0"
},
{
"status": "affected",
"version": "7.49.1"
},
{
"status": "affected",
"version": "7.49.0"
},
{
"status": "affected",
"version": "7.48.0"
},
{
"status": "affected",
"version": "7.47.1"
},
{
"status": "affected",
"version": "7.47.0"
},
{
"status": "affected",
"version": "7.46.0"
},
{
"status": "affected",
"version": "7.45.0"
},
{
"status": "affected",
"version": "7.44.0"
},
{
"status": "affected",
"version": "7.43.0"
},
{
"status": "affected",
"version": "7.42.1"
},
{
"status": "affected",
"version": "7.42.0"
},
{
"status": "affected",
"version": "7.41.0"
},
{
"status": "affected",
"version": "7.40.0"
},
{
"status": "affected",
"version": "7.39.0"
},
{
"status": "affected",
"version": "7.38.0"
},
{
"status": "affected",
"version": "7.37.1"
},
{
"status": "affected",
"version": "7.37.0"
},
{
"status": "affected",
"version": "7.36.0"
},
{
"status": "affected",
"version": "7.35.0"
},
{
"status": "affected",
"version": "7.34.0"
},
{
"status": "affected",
"version": "7.33.0"
},
{
"status": "affected",
"version": "7.32.0"
},
{
"status": "affected",
"version": "7.31.0"
},
{
"status": "affected",
"version": "7.30.0"
},
{
"status": "affected",
"version": "7.29.0"
},
{
"status": "affected",
"version": "7.28.1"
},
{
"status": "affected",
"version": "7.28.0"
},
{
"status": "affected",
"version": "7.27.0"
},
{
"status": "affected",
"version": "7.26.0"
},
{
"status": "affected",
"version": "7.25.0"
},
{
"status": "affected",
"version": "7.24.0"
},
{
"status": "affected",
"version": "7.23.1"
},
{
"status": "affected",
"version": "7.23.0"
},
{
"status": "affected",
"version": "7.22.0"
},
{
"status": "affected",
"version": "7.21.7"
},
{
"status": "affected",
"version": "7.21.6"
},
{
"status": "affected",
"version": "7.21.5"
},
{
"status": "affected",
"version": "7.21.4"
},
{
"status": "affected",
"version": "7.21.3"
},
{
"status": "affected",
"version": "7.21.2"
},
{
"status": "affected",
"version": "7.21.1"
},
{
"status": "affected",
"version": "7.21.0"
},
{
"status": "affected",
"version": "7.20.1"
},
{
"status": "affected",
"version": "7.20.0"
},
{
"status": "affected",
"version": "7.19.7"
},
{
"status": "affected",
"version": "7.19.6"
},
{
"status": "affected",
"version": "7.19.5"
},
{
"status": "affected",
"version": "7.19.4"
},
{
"status": "affected",
"version": "7.19.3"
},
{
"status": "affected",
"version": "7.19.2"
},
{
"status": "affected",
"version": "7.19.1"
},
{
"status": "affected",
"version": "7.19.0"
},
{
"status": "affected",
"version": "7.18.2"
},
{
"status": "affected",
"version": "7.18.1"
},
{
"status": "affected",
"version": "7.18.0"
},
{
"status": "affected",
"version": "7.17.1"
},
{
"status": "affected",
"version": "7.17.0"
},
{
"status": "affected",
"version": "7.16.4"
},
{
"status": "affected",
"version": "7.16.3"
},
{
"status": "affected",
"version": "7.16.2"
},
{
"status": "affected",
"version": "7.16.1"
},
{
"status": "affected",
"version": "7.16.0"
},
{
"status": "affected",
"version": "7.15.5"
},
{
"status": "affected",
"version": "7.15.4"
},
{
"status": "affected",
"version": "7.15.3"
},
{
"status": "affected",
"version": "7.15.2"
},
{
"status": "affected",
"version": "7.15.1"
},
{
"status": "affected",
"version": "7.15.0"
},
{
"status": "affected",
"version": "7.14.1"
},
{
"status": "affected",
"version": "7.14.0"
},
{
"status": "affected",
"version": "7.13.2"
},
{
"status": "affected",
"version": "7.13.1"
},
{
"status": "affected",
"version": "7.13.0"
},
{
"status": "affected",
"version": "7.12.3"
},
{
"status": "affected",
"version": "7.12.2"
},
{
"status": "affected",
"version": "7.12.1"
},
{
"status": "affected",
"version": "7.12.0"
},
{
"status": "affected",
"version": "7.11.2"
},
{
"status": "affected",
"version": "7.11.1"
},
{
"status": "affected",
"version": "7.11.0"
},
{
"status": "affected",
"version": "7.10.8"
},
{
"status": "affected",
"version": "7.10.7"
},
{
"status": "affected",
"version": "7.10.6"
},
{
"status": "affected",
"version": "7.10.5"
},
{
"status": "affected",
"version": "7.10.4"
},
{
"status": "affected",
"version": "7.10.3"
},
{
"status": "affected",
"version": "7.10.2"
},
{
"status": "affected",
"version": "7.10.1"
},
{
"status": "affected",
"version": "7.10"
},
{
"status": "affected",
"version": "7.9.8"
},
{
"status": "affected",
"version": "7.9.7"
},
{
"status": "affected",
"version": "7.9.6"
},
{
"status": "affected",
"version": "7.9.5"
},
{
"status": "affected",
"version": "7.9.4"
},
{
"status": "affected",
"version": "7.9.3"
},
{
"status": "affected",
"version": "7.9.2"
},
{
"status": "affected",
"version": "7.9.1"
},
{
"status": "affected",
"version": "7.9"
},
{
"status": "affected",
"version": "7.8.1"
},
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "7.7.3"
},
{
"status": "affected",
"version": "7.7.2"
},
{
"status": "affected",
"version": "7.7.1"
},
{
"status": "affected",
"version": "7.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhamad Arga Reksapati (HackerOne: nobcoder)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Stefan Eissing"
}
],
"descriptions": [
{
"lang": "en",
"value": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T06:02:54.443Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"url": "https://curl.se/docs/CVE-2026-3784.json"
},
{
"url": "https://curl.se/docs/CVE-2026-3784.html"
},
{
"url": "https://hackerone.com/reports/3584903"
}
],
"title": "wrong proxy connection reuse with credentials",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_osv": {
"affected": [
{
"ranges": [
{
"events": [
{
"introduced": "7.7.0"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.19.0"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4"
},
{
"fixed": "5f13a7645e565c5c1a06f3ef86e97afb856fb364"
}
],
"repo": "https://github.com/curl/curl.git",
"type": "GIT"
}
],
"versions": [
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0",
"7.13.2",
"7.13.1",
"7.13.0",
"7.12.3",
"7.12.2",
"7.12.1",
"7.12.0",
"7.11.2",
"7.11.1",
"7.11.0",
"7.10.8",
"7.10.7",
"7.10.6",
"7.10.5",
"7.10.4",
"7.10.3",
"7.10.2",
"7.10.1",
"7.10",
"7.9.8",
"7.9.7",
"7.9.6",
"7.9.5",
"7.9.4",
"7.9.3",
"7.9.2",
"7.9.1",
"7.9",
"7.8.1",
"7.8",
"7.7.3",
"7.7.2",
"7.7.1",
"7.7"
]
}
],
"aliases": [
"CVE-2026-3784"
],
"credits": [
{
"name": "Muhamad Arga Reksapati (HackerOne: nobcoder)",
"type": "finder"
},
{
"name": "Stefan Eissing",
"type": "remediation developer"
}
],
"database_specific": {
"CWE": {
"desc": "Authentication Bypass by Primary Weakness",
"id": "CWE-305"
},
"URL": "https://curl.se/docs/CVE-2026-3784.json",
"affects": "both",
"issue": "https://hackerone.com/reports/3584903",
"last_affected": "8.18.0",
"package": "curl",
"severity": "Low",
"www": "https://curl.se/docs/CVE-2026-3784.html"
},
"details": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.",
"id": "CURL-CVE-2026-3784",
"modified": "2026-09-07T10:34:51.00Z",
"published": "2026-03-11T08:00:00.00Z",
"schema_version": "1.5.0",
"summary": "wrong proxy connection reuse with credentials"
}
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-3784",
"datePublished": "2026-03-11T10:09:21.418Z",
"dateReserved": "2026-03-08T05:09:52.279Z",
"dateUpdated": "2026-09-15T06:02:54.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3591 (GCVE-0-2026-3591)
Vulnerability from cvelistv5 – Published: 2026-03-25 13:34 – Updated: 2026-03-25 14:13
VLAI
EPSS
VEX
Title
A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass
Summary
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 14:12 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://kb.isc.org/docs/cve-2026-3591 | vendor-advisory |
| https://downloads.isc.org/isc/bind9/9.20.21 | patch |
| https://downloads.isc.org/isc/bind9/9.21.20 | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ISC | BIND 9 |
Affected:
9.20.0 , ≤ 9.20.20
(custom)
Affected: 9.21.0 , ≤ 9.21.19 (custom) Affected: 9.20.9-S1 , ≤ 9.20.20-S1 (custom) Unaffected: 9.18.0 , ≤ 9.18.46 (custom) Unaffected: 9.18.11-S1 , ≤ 9.18.46-S1 (custom) cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* |
Date Public
2026-03-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T14:12:43.295485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T14:13:01.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BIND 9",
"vendor": "ISC",
"versions": [
{
"lessThanOrEqual": "9.20.20",
"status": "affected",
"version": "9.20.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.21.19",
"status": "affected",
"version": "9.21.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.20.20-S1",
"status": "affected",
"version": "9.20.9-S1",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.18.46",
"status": "unaffected",
"version": "9.18.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.18.46-S1",
"status": "unaffected",
"version": "9.18.11-S1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.20.20",
"versionStartIncluding": "9.20.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.21.19",
"versionStartIncluding": "9.21.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.20.20-S1",
"versionStartIncluding": "9.20.9-S1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.18.46",
"versionStartIncluding": "9.18.0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.18.46-S1",
"versionStartIncluding": "9.18.11-S1",
"vulnerable": false
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "ISC would like to thank Mcsky23 for bringing this vulnerability to our attention."
}
],
"datePublic": "2026-03-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."
}
],
"exploits": [
{
"lang": "en",
"value": "We are not aware of any active exploits."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-562",
"description": "CWE-562 Return of Stack Variable Address",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T13:34:14.202Z",
"orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
"shortName": "isc"
},
"references": [
{
"name": "CVE-2026-3591",
"tags": [
"vendor-advisory"
],
"url": "https://kb.isc.org/docs/cve-2026-3591"
},
{
"tags": [
"patch"
],
"url": "https://downloads.isc.org/isc/bind9/9.20.21"
},
{
"tags": [
"patch"
],
"url": "https://downloads.isc.org/isc/bind9/9.21.20"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.21, 9.21.20, or 9.20.21-S1."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass",
"workarounds": [
{
"lang": "en",
"value": "No workarounds known."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
"assignerShortName": "isc",
"cveId": "CVE-2026-3591",
"datePublished": "2026-03-25T13:34:14.202Z",
"dateReserved": "2026-03-05T12:50:58.915Z",
"dateUpdated": "2026-03-25T14:13:01.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3047 (GCVE-0-2026-3047)
Vulnerability from cvelistv5 – Published: 2026-03-05 18:28 – Updated: 2026-07-15 01:09
VLAI
EPSS
VEX
Title
Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login
Summary
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-06 18:13 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:3925 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:3926 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:3947 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:3948 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-3047 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2441966 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 |
Unaffected:
26.2.14-1 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.2::el9 |
|
| Red Hat | Red Hat build of Keycloak 26.2 |
Unaffected:
26.2-16 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.2::el9 |
|
| Red Hat | Red Hat build of Keycloak 26.2.14 |
cpe:/a:redhat:build_keycloak:26.2::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4 |
Unaffected:
26.4.10-1 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.4::el9 |
|
| Red Hat | Red Hat build of Keycloak 26.4 |
Unaffected:
26.4-12 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.4::el9 |
|
| Red Hat | Red Hat build of Keycloak 26.4.10 |
cpe:/a:redhat:build_keycloak:26.4::el9
|
Date Public
2026-03-05 11:24
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3047",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T18:13:06.967396Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T18:13:14.612Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.2.14-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.2-16",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.2-16",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "unaffected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.2.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4.10-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "unaffected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.4.10",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-05T11:24:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:09:59.742Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-3047"
},
{
"name": "RHBZ#2441966",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441966"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3047.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3925"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3948"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3926"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3947"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:3925: Red Hat build of Keycloak 26.2"
},
{
"lang": "en",
"value": "RHSA-2026:3948: Red Hat build of Keycloak 26.4"
},
{
"lang": "en",
"value": "RHSA-2026:3926: Red Hat build of Keycloak 26.2.14"
},
{
"lang": "en",
"value": "RHSA-2026:3947: Red Hat build of Keycloak 26.4.10"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-23T17:29:50.192Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-05T11:24:00.000Z",
"value": "Made public."
}
],
"title": "org.keycloak.broker.saml: Keycloak SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, ensure that any SAML client intended to be disabled is not configured as an IdP-initiated broker landing target within Keycloak. Review your Keycloak realm configurations to identify and remove any such associations for disabled clients."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.2.14-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.2-16",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.2-16",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"defaultStatus": "unaffected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.2.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4.10-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "unaffected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.4.10",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-05T11:24:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T02:36:29.782Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:3925",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3925"
},
{
"name": "RHSA-2026:3926",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3926"
},
{
"name": "RHSA-2026:3947",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3947"
},
{
"name": "RHSA-2026:3948",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:3948"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-3047"
},
{
"name": "RHBZ#2441966",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441966"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-23T17:29:50.192Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-05T11:24:00.000Z",
"value": "Made public."
}
],
"title": "Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, ensure that any SAML client intended to be disabled is not configured as an IdP-initiated broker landing target within Keycloak. Review your Keycloak realm configurations to identify and remove any such associations for disabled clients."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-305: Authentication Bypass by Primary Weakness"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-3047",
"datePublished": "2026-03-05T18:28:36.337Z",
"dateReserved": "2026-02-23T17:30:53.926Z",
"dateUpdated": "2026-07-15T01:09:59.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2652 (GCVE-0-2026-2652)
Vulnerability from cvelistv5 – Published: 2026-05-15 02:13 – Updated: 2026-05-15 13:22
VLAI
EPSS
VEX
Title
Authentication Bypass in mlflow/mlflow
Summary
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.
Severity
8.6 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-15 13:22 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mlflow | mlflow/mlflow |
Affected:
unspecified , < 3.10.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2652",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T13:22:14.645523Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T13:22:21.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mlflow/mlflow",
"vendor": "mlflow",
"versions": [
{
"lessThan": "3.10.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T02:13:19.541Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai"
},
"references": [
{
"url": "https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756"
},
{
"url": "https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa"
}
],
"source": {
"advisory": "5aeff5f0-49c7-4180-b5cb-c9a046f16756",
"discovery": "EXTERNAL"
},
"title": "Authentication Bypass in mlflow/mlflow"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"cveId": "CVE-2026-2652",
"datePublished": "2026-05-15T02:13:19.541Z",
"dateReserved": "2026-02-18T02:53:33.607Z",
"dateUpdated": "2026-05-15T13:22:21.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1965 (GCVE-0-2026-1965)
Vulnerability from cvelistv5 – Published: 2026-03-11 10:08 – Updated: 2026-09-15 06:02
VLAI
EPSS
VEX
Title
bad reuse of HTTP Negotiate connection
Summary
libcurl can in some circumstances reuse the wrong connection when asked to do
an Negotiate-authenticated HTTP or HTTPS request.
libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criterion must first be met. Due to a
logical error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different credentials. One underlying reason being that
Negotiate sometimes authenticates *connections* and not *requests*, contrary
to how HTTP is designed to work.
An application that allows Negotiate authentication to a server (that responds
wanting Negotiate) with `user1:password1` and then does another operation to
the same server also using Negotiate but with `user2:password2` (while the
previous connection is still alive) - the second request wrongly reused the
same connection and since it then sees that the Negotiate negotiation is
already made, it sends the request over that connection thinking it uses
the user2 credentials when it is in fact still using the connection
authenticated for user1...
The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.
Applications can disable libcurl's reuse of connections and thus mitigate this
problem, by using one of the following libcurl options to alter how
connections are or are not reused: `CURLOPT_FRESH_CONNECT`,
`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the
curl_multi API).
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-11 14:31 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl |
Affected:
7.10.6 , < 8.14.2
(semver)
Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.19.0 (semver) |
|
| curl | curl |
Affected:
e56ae1426cb7a0a4a427cf8d6099a821fdaae428 , < f1a39f221d57354990e3eeeddc3404aede2aff70
(git)
|
|
| curl | curl |
Affected:
8.18.0
Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0 Affected: 7.13.2 Affected: 7.13.1 Affected: 7.13.0 Affected: 7.12.3 Affected: 7.12.2 Affected: 7.12.1 Affected: 7.12.0 Affected: 7.11.2 Affected: 7.11.1 Affected: 7.11.0 Affected: 7.10.8 Affected: 7.10.7 Affected: 7.10.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-1965",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-11T14:31:56.061598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T14:32:38.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThan": "8.14.2",
"status": "affected",
"version": "7.10.6",
"versionType": "semver"
},
{
"lessThan": "8.16.1",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThan": "8.19.0",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"versions": [
{
"lessThan": "f1a39f221d57354990e3eeeddc3404aede2aff70",
"status": "affected",
"version": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"status": "affected",
"version": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0"
},
{
"status": "affected",
"version": "8.11.1"
},
{
"status": "affected",
"version": "8.11.0"
},
{
"status": "affected",
"version": "8.10.1"
},
{
"status": "affected",
"version": "8.10.0"
},
{
"status": "affected",
"version": "8.9.1"
},
{
"status": "affected",
"version": "8.9.0"
},
{
"status": "affected",
"version": "8.8.0"
},
{
"status": "affected",
"version": "8.7.1"
},
{
"status": "affected",
"version": "8.7.0"
},
{
"status": "affected",
"version": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0"
},
{
"status": "affected",
"version": "8.4.0"
},
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.2.1"
},
{
"status": "affected",
"version": "8.2.0"
},
{
"status": "affected",
"version": "8.1.2"
},
{
"status": "affected",
"version": "8.1.1"
},
{
"status": "affected",
"version": "8.1.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "7.88.1"
},
{
"status": "affected",
"version": "7.88.0"
},
{
"status": "affected",
"version": "7.87.0"
},
{
"status": "affected",
"version": "7.86.0"
},
{
"status": "affected",
"version": "7.85.0"
},
{
"status": "affected",
"version": "7.84.0"
},
{
"status": "affected",
"version": "7.83.1"
},
{
"status": "affected",
"version": "7.83.0"
},
{
"status": "affected",
"version": "7.82.0"
},
{
"status": "affected",
"version": "7.81.0"
},
{
"status": "affected",
"version": "7.80.0"
},
{
"status": "affected",
"version": "7.79.1"
},
{
"status": "affected",
"version": "7.79.0"
},
{
"status": "affected",
"version": "7.78.0"
},
{
"status": "affected",
"version": "7.77.0"
},
{
"status": "affected",
"version": "7.76.1"
},
{
"status": "affected",
"version": "7.76.0"
},
{
"status": "affected",
"version": "7.75.0"
},
{
"status": "affected",
"version": "7.74.0"
},
{
"status": "affected",
"version": "7.73.0"
},
{
"status": "affected",
"version": "7.72.0"
},
{
"status": "affected",
"version": "7.71.1"
},
{
"status": "affected",
"version": "7.71.0"
},
{
"status": "affected",
"version": "7.70.0"
},
{
"status": "affected",
"version": "7.69.1"
},
{
"status": "affected",
"version": "7.69.0"
},
{
"status": "affected",
"version": "7.68.0"
},
{
"status": "affected",
"version": "7.67.0"
},
{
"status": "affected",
"version": "7.66.0"
},
{
"status": "affected",
"version": "7.65.3"
},
{
"status": "affected",
"version": "7.65.2"
},
{
"status": "affected",
"version": "7.65.1"
},
{
"status": "affected",
"version": "7.65.0"
},
{
"status": "affected",
"version": "7.64.1"
},
{
"status": "affected",
"version": "7.64.0"
},
{
"status": "affected",
"version": "7.63.0"
},
{
"status": "affected",
"version": "7.62.0"
},
{
"status": "affected",
"version": "7.61.1"
},
{
"status": "affected",
"version": "7.61.0"
},
{
"status": "affected",
"version": "7.60.0"
},
{
"status": "affected",
"version": "7.59.0"
},
{
"status": "affected",
"version": "7.58.0"
},
{
"status": "affected",
"version": "7.57.0"
},
{
"status": "affected",
"version": "7.56.1"
},
{
"status": "affected",
"version": "7.56.0"
},
{
"status": "affected",
"version": "7.55.1"
},
{
"status": "affected",
"version": "7.55.0"
},
{
"status": "affected",
"version": "7.54.1"
},
{
"status": "affected",
"version": "7.54.0"
},
{
"status": "affected",
"version": "7.53.1"
},
{
"status": "affected",
"version": "7.53.0"
},
{
"status": "affected",
"version": "7.52.1"
},
{
"status": "affected",
"version": "7.52.0"
},
{
"status": "affected",
"version": "7.51.0"
},
{
"status": "affected",
"version": "7.50.3"
},
{
"status": "affected",
"version": "7.50.2"
},
{
"status": "affected",
"version": "7.50.1"
},
{
"status": "affected",
"version": "7.50.0"
},
{
"status": "affected",
"version": "7.49.1"
},
{
"status": "affected",
"version": "7.49.0"
},
{
"status": "affected",
"version": "7.48.0"
},
{
"status": "affected",
"version": "7.47.1"
},
{
"status": "affected",
"version": "7.47.0"
},
{
"status": "affected",
"version": "7.46.0"
},
{
"status": "affected",
"version": "7.45.0"
},
{
"status": "affected",
"version": "7.44.0"
},
{
"status": "affected",
"version": "7.43.0"
},
{
"status": "affected",
"version": "7.42.1"
},
{
"status": "affected",
"version": "7.42.0"
},
{
"status": "affected",
"version": "7.41.0"
},
{
"status": "affected",
"version": "7.40.0"
},
{
"status": "affected",
"version": "7.39.0"
},
{
"status": "affected",
"version": "7.38.0"
},
{
"status": "affected",
"version": "7.37.1"
},
{
"status": "affected",
"version": "7.37.0"
},
{
"status": "affected",
"version": "7.36.0"
},
{
"status": "affected",
"version": "7.35.0"
},
{
"status": "affected",
"version": "7.34.0"
},
{
"status": "affected",
"version": "7.33.0"
},
{
"status": "affected",
"version": "7.32.0"
},
{
"status": "affected",
"version": "7.31.0"
},
{
"status": "affected",
"version": "7.30.0"
},
{
"status": "affected",
"version": "7.29.0"
},
{
"status": "affected",
"version": "7.28.1"
},
{
"status": "affected",
"version": "7.28.0"
},
{
"status": "affected",
"version": "7.27.0"
},
{
"status": "affected",
"version": "7.26.0"
},
{
"status": "affected",
"version": "7.25.0"
},
{
"status": "affected",
"version": "7.24.0"
},
{
"status": "affected",
"version": "7.23.1"
},
{
"status": "affected",
"version": "7.23.0"
},
{
"status": "affected",
"version": "7.22.0"
},
{
"status": "affected",
"version": "7.21.7"
},
{
"status": "affected",
"version": "7.21.6"
},
{
"status": "affected",
"version": "7.21.5"
},
{
"status": "affected",
"version": "7.21.4"
},
{
"status": "affected",
"version": "7.21.3"
},
{
"status": "affected",
"version": "7.21.2"
},
{
"status": "affected",
"version": "7.21.1"
},
{
"status": "affected",
"version": "7.21.0"
},
{
"status": "affected",
"version": "7.20.1"
},
{
"status": "affected",
"version": "7.20.0"
},
{
"status": "affected",
"version": "7.19.7"
},
{
"status": "affected",
"version": "7.19.6"
},
{
"status": "affected",
"version": "7.19.5"
},
{
"status": "affected",
"version": "7.19.4"
},
{
"status": "affected",
"version": "7.19.3"
},
{
"status": "affected",
"version": "7.19.2"
},
{
"status": "affected",
"version": "7.19.1"
},
{
"status": "affected",
"version": "7.19.0"
},
{
"status": "affected",
"version": "7.18.2"
},
{
"status": "affected",
"version": "7.18.1"
},
{
"status": "affected",
"version": "7.18.0"
},
{
"status": "affected",
"version": "7.17.1"
},
{
"status": "affected",
"version": "7.17.0"
},
{
"status": "affected",
"version": "7.16.4"
},
{
"status": "affected",
"version": "7.16.3"
},
{
"status": "affected",
"version": "7.16.2"
},
{
"status": "affected",
"version": "7.16.1"
},
{
"status": "affected",
"version": "7.16.0"
},
{
"status": "affected",
"version": "7.15.5"
},
{
"status": "affected",
"version": "7.15.4"
},
{
"status": "affected",
"version": "7.15.3"
},
{
"status": "affected",
"version": "7.15.2"
},
{
"status": "affected",
"version": "7.15.1"
},
{
"status": "affected",
"version": "7.15.0"
},
{
"status": "affected",
"version": "7.14.1"
},
{
"status": "affected",
"version": "7.14.0"
},
{
"status": "affected",
"version": "7.13.2"
},
{
"status": "affected",
"version": "7.13.1"
},
{
"status": "affected",
"version": "7.13.0"
},
{
"status": "affected",
"version": "7.12.3"
},
{
"status": "affected",
"version": "7.12.2"
},
{
"status": "affected",
"version": "7.12.1"
},
{
"status": "affected",
"version": "7.12.0"
},
{
"status": "affected",
"version": "7.11.2"
},
{
"status": "affected",
"version": "7.11.1"
},
{
"status": "affected",
"version": "7.11.0"
},
{
"status": "affected",
"version": "7.10.8"
},
{
"status": "affected",
"version": "7.10.7"
},
{
"status": "affected",
"version": "7.10.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhicheng Chen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Daniel Stenberg"
}
],
"descriptions": [
{
"lang": "en",
"value": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl\u0027s reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T06:02:49.175Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"url": "https://curl.se/docs/CVE-2026-1965.json"
},
{
"url": "https://curl.se/docs/CVE-2026-1965.html"
}
],
"title": "bad reuse of HTTP Negotiate connection",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_osv": {
"affected": [
{
"ranges": [
{
"events": [
{
"introduced": "7.10.6"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.19.0"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428"
},
{
"fixed": "f1a39f221d57354990e3eeeddc3404aede2aff70"
}
],
"repo": "https://github.com/curl/curl.git",
"type": "GIT"
}
],
"versions": [
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0",
"7.13.2",
"7.13.1",
"7.13.0",
"7.12.3",
"7.12.2",
"7.12.1",
"7.12.0",
"7.11.2",
"7.11.1",
"7.11.0",
"7.10.8",
"7.10.7",
"7.10.6"
]
}
],
"aliases": [
"CVE-2026-1965"
],
"credits": [
{
"name": "Zhicheng Chen",
"type": "finder"
},
{
"name": "Daniel Stenberg",
"type": "remediation developer"
}
],
"database_specific": {
"CWE": {
"desc": "Authentication Bypass by Primary Weakness",
"id": "CWE-305"
},
"URL": "https://curl.se/docs/CVE-2026-1965.json",
"affects": "both",
"last_affected": "8.18.0",
"package": "curl",
"severity": "Medium",
"www": "https://curl.se/docs/CVE-2026-1965.html"
},
"details": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl\u0027s reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).",
"id": "CURL-CVE-2026-1965",
"modified": "2026-09-07T10:34:51.00Z",
"published": "2026-03-11T08:00:00.00Z",
"schema_version": "1.5.0",
"summary": "bad reuse of HTTP Negotiate connection"
}
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-1965",
"datePublished": "2026-03-11T10:08:52.431Z",
"dateReserved": "2026-02-05T11:00:50.882Z",
"dateUpdated": "2026-09-15T06:02:49.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1713 (GCVE-0-2026-1713)
Vulnerability from cvelistv5 – Published: 2026-03-03 20:28 – Updated: 2026-03-03 20:49
VLAI
EPSS
VEX
Title
IBM MQ is affected by an authority vulnerablility
Summary
IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-03 20:49 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7261944 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | MQ |
Affected:
9.1.0.0 , ≤ 9.1.0.33 LTS
(semver)
Affected: 9.2.0.0 , ≤ 9.2.0.40 LTS (semver) Affected: 9.3.0.0 , ≤ 9.3.0.36 LTS (semver) Affected: 9.30.0 , ≤ 9.3.5.1 CD (semver) Affected: 9.4.0.0 , ≤ 9.4.0.17 LTS (semver) Affected: 9.4.0.0 , ≤ 9.4.4.1 CD (semver) cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.1.0.33:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.2.0.40:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.3.0.36:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.30.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.4.0.17:*:*:*:*:*:*:* cpe:2.3:a:ibm:mq:9.4.4.1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-1713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-03T20:49:06.741799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-03T20:49:10.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.1.0.33:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.2.0.40:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.3.0.36:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.30.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.4.0.17:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:mq:9.4.4.1:*:*:*:*:*:*:*"
],
"product": "MQ",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "9.1.0.33 LTS",
"status": "affected",
"version": "9.1.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.2.0.40 LTS",
"status": "affected",
"version": "9.2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.3.0.36 LTS",
"status": "affected",
"version": "9.3.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.3.5.1 CD",
"status": "affected",
"version": "9.30.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.0.17 LTS",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.4.1 CD",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD\u003c/p\u003e"
}
],
"value": "IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-03T20:33:23.734Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7261944"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eThis issue was addressed under Known Issue DT433340\u003c/p\u003e\u003cp\u003eIBM MQ version 9.1 LTS\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts\"\u003eApply cumulative security update 9.1.0.34\u003c/a\u003e\u003c/p\u003e\u003cp\u003eIBM MQ version 9.2 LTS\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts\"\u003eApply cumulative security update 9.2.0.41\u003c/a\u003e\u0026nbsp; \u003c/p\u003e\u003cp\u003eIBM MQ version 9.3 LTS\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts\"\u003eApply cumulative security update 9.3.0.37\u003c/a\u003e\u0026nbsp; \u003c/p\u003e\u003cp\u003eIBM MQ version 9.4 LTS\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\"\u003eApply fixpack 9.4.0.20\u003c/a\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003eIBM MQ version 9.3 CD and 9.4 CD\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-cd\"\u003eUpgrade to IBM MQ version 9.4.5.0\u003c/a\u003e\u0026nbsp;or later continuous delivery release\u003c/p\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "This issue was addressed under Known Issue DT433340\n\nIBM MQ version 9.1 LTS\n\n Apply cumulative security update 9.1.0.34 https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts \n\nIBM MQ version 9.2 LTS\n\n Apply cumulative security update 9.2.0.41 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts \u00a0 \n\nIBM MQ version 9.3 LTS\n\n Apply cumulative security update 9.3.0.37 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts \u00a0 \n\nIBM MQ version 9.4 LTS\n\n Apply fixpack 9.4.0.20 https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts \u00a0\n\nIBM MQ version 9.3 CD and 9.4 CD\n\n Upgrade to IBM MQ version 9.4.5.0 https://www.ibm.com/support/pages/downloading-ibm-mq-94-cd \u00a0or later continuous delivery release"
}
],
"title": "IBM MQ is affected by an authority vulnerablility",
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-1713",
"datePublished": "2026-03-03T20:28:42.869Z",
"dateReserved": "2026-01-30T18:45:45.742Z",
"dateUpdated": "2026-03-03T20:49:10.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1621 (GCVE-0-2026-1621)
Vulnerability from cvelistv5 – Published: 2026-08-14 14:08 – Updated: 2026-08-14 14:37
VLAI
EPSS
VEX
Title
Register Bypass in Universal Sotware's E-Municipality
Summary
Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers.
This issue affects E-Municipality: from 20251127 before 20260204.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 14:37 UTC
CWE
- CWE-305 - Authentication bypass by primary weakness
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Universal Software Inc. | E-Municipality |
Affected:
20251127 , < 20260204
(custom)
|
Date Public
2026-08-14 14:02
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1621",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T14:37:00.523197Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:37:12.458Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "E-Municipality",
"vendor": "Universal Software Inc.",
"versions": [
{
"lessThan": "20260204",
"status": "affected",
"version": "20251127",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u0130brahim Y\u0130\u011e\u0130TSOY"
}
],
"datePublic": "2026-08-14T14:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers.\u003cp\u003eThis issue affects E-Municipality: from 20251127 before 20260204.\u003c/p\u003e"
}
],
"value": "Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers.\n\nThis issue affects E-Municipality: from 20251127 before 20260204."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication bypass by primary weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:08:37.355Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0846"
}
],
"source": {
"advisory": "TR-26-0846",
"defect": [
"TR-26-0846"
],
"discovery": "UNKNOWN"
},
"title": "Register Bypass in Universal Sotware\u0027s E-Municipality",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-1621",
"datePublished": "2026-08-14T14:08:37.355Z",
"dateReserved": "2026-01-29T14:20:16.810Z",
"dateUpdated": "2026-08-14T14:37:12.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.