Upwind Security MDR

🚨 CRITICAL - Unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3) A critical vulnerability in React Server Components packages (react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel) allows unauthenticated remote attackers to execute arbitrary code via crafted RSC Flight payload responses transporting multiple typed arrays and attacker-controlled values. 👉 Affected: Versions 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 | Upgrade immediately to 19.0.9, 19.1.10, 19.2.9, or 19.3.1 (or Next.js 16.4.1 / 15.5.28) github.com/react/react/secur…

🚨High - Apache Airflow Scheduler RCE/DoS via next_kwargs Deserialization (CVE-2026-67260) Apache Airflow 3.3.0 adds an awaiting_input scheduler sweep that deserializes TaskInstance.next_kwargs without an allow-list; a DAG author can set next_kwargs via the task execution API to trigger arbitrary module import/object instantiation in the scheduler process or crash it. Versions < 3.3.0 are not affected. 👉Affected: apache-airflow / apache-airflow-core 3.3.0 | Upgrade to 3.3.1

🚨High - PackageKit Zypp Backend Relative Path Traversal LPE (CVE-2026-104620) PackageKit’s zypp backend mishandles relative paths during InstallFiles() when SIMULATE is set, allowing ../ traversal in the simulated install flow. A local attacker can leverage the traversal to write/overwrite privileged paths and escalate to root. Non-zypp backends are not impacted. 👉Affected: PackageKit < 1.4.1 | Upgrade to 1.4.1

🚨 CRITICAL - Unauthenticated Arbitrary File Upload & RCE in WidzialniCMS CERT Polska has coordinated disclosure of two critical unrestricted file upload flaws in WidzialniCMS allowing unauthenticated remote attackers to achieve Remote Code Execution: • CVE-2026-110468: Arbitrary file upload via /panel/controllers/save_photo.php due to client-controlled permission checks and unvalidated currentpath. • CVE-2026-110469: Arbitrary file upload via /panel/upload.php caused by client-side permission checks and unvalidated uploadPath. 👉 Affected: WidzialniCMS versions prior to 2.5 | Upgrade immediately to v2.5 to remediate.

🚨 HIGH - Authorization Bypass Flaw in mcp-atlassian Scopes (GHSA-xv8h-26ch-vfh9) A security vulnerability in the mcp-atlassian Model Context Protocol (MCP) server allows callers to bypass configured project and space isolation boundaries. Previously, JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER were not enforced across every tool, permitting unauthorized write operations and PAT-header requests to interact with restricted projects/spaces. 👉 Affected: mcp-atlassian prior to 0.24.1 | Upgrade to v0.24.1 immediately, especially when running HTTP transports (sse, streamable-http) or relying on tenant isolation filters. github.com/sooperset/mcp-atl…

🚨Critical - Keycloak Authorization JS Policy RCE via Stale Session Attribute (CVE-2026-120984) Keycloak client management (keycloak-services) fails to clear an internal session attribute when creating/importing a client with Authorization Services enabled. An authenticated user with client management permissions can bypass checks and upload a malicious JavaScript policy that executes server-side during authorization evaluation, leading to RCE and potential full host compromise. 👉Affected: keycloak-services, rhbk/keycloak-rhel9 (versions TBD)

🚨 CRITICAL - LXD Custom Volume Project Restriction Bypass (GHSA-7mr3-28h5-m5vx) A high-severity access control flaw in Canonical LXD custom volume copying allows an attacker who knows the name of a restricted project and a target custom volume to bypass project boundaries. By supplying an attacker-controlled source project parameter during storage volume creation, low-privileged users can copy unauthorized custom volumes across projects and exfiltrate sensitive data. 🔍 Advisories: GHSA-7mr3-28h5-m5vx, GHSA-9j25-mm2h-2f76, GHSA-fmc8-p6q7-75cc, GHSA-jpf8-86f3-wp38, GHSA-pjff-c2wc-f6jm, GHSA-qx75-2p3r-pwm5, GHSA-vghh-5rfx-xhq8 👉 Affected: Canonical LXD versions prior to patched releases (e.g., v5.0.7, v5.21.5, v6.8) | Upgrade immediately to fixed LXD releases.

🚨High - Hickory DNS DNSSEC Validation Bypasses (CVE-2026-123605 / CVE-2026-123595) In hickory-proto/hickory-net, DnssecDnsHandle verifies an RRSIG using the DNSKEY from the signature’s Signer Name without enforcing that it matches the RRset’s zone (CVE-2026-123605). Separately, the NSEC3 handler matches the closest encloser by hash alone and accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence (CVE-2026-123595). An attacker controlling any DNSSEC-signed zone can forge “authenticated” records or force NXDOMAIN/NODATA with AD=1 for unrelated zones, poisoning validating resolvers/recursors/clients 👉Affected: hickory-proto, hickory-net (DnssecDnsHandle / validating recursor users) | Upgrade to ≥ 0.26.2

🚨High - Agenta SSRF via Workflow Revision URL Override (CVE-2026-123786) Agenta <0.122.5 allows SSRF when a workspace member with workflow edit rights sets an arbitrary revision URL, redirecting workflow invocations. This can exfiltrate the secret-resolve Authorization token to read provider secrets via the vault API and probe internal services/cloud metadata endpoints. 👉Affected: agenta < 0.122.5 | Upgrade to 0.122.5

🚨High - plist.js Binary Plist Parser Uncontrolled Resource Consumption (CVE-2026-124078) plist (npm) parseBinary recursively resolves shared object references without memoization; a tiny crafted binary plist with self-referencing object indices triggers exponential resolution and memory growth. This can crash the Node.js process via OOM, causing DoS. 👉Affected: plist < 5.0.1 | Upgrade to 5.0.1

🚨Critical - Apache Arrow Rust arrow OOB Read in RunEndEncoded Validation (CVE-2026-111959) Apache Arrow Rust's arrow crate ArrayData interface improperly validates RunEndEncoded arrays, allowing crafted run_ends to index past the child values buffer and trigger an out-of-bounds read beyond the child values array. This can leak in-process memory and crash consumers. 👉Affected: Apache Arrow Rust arrow crate < 57.3.2, 58.x < 58.4.1, 59.x < 59.3.2, 60.x < 60.1.0 | Upgrade to 60.1.0 / 59.3.2 / 58.4.1 / 57.3.2

🚨High - Multiple devalue DoS flaws (CVE-2026-123562 / 123563 / 123564 / 123565 / 123566 / 123569) Sveltejs devalue has several high-severity issues fixed in 5.9.3 (some earlier in 5.6.3): sparse-array CPU amplification & memory exhaustion in uneval(), quadratic expansion from repeated strings, typed-array allocation bypass in parse(), unhandled rejection in stringifyAsync that can crash Node, and excessive CPU/memory on sparse-array serialization. 👉Affected: devalue < 5.9.3 (check specific ranges) | Upgrade to 5.9.3

🚨Critical - Gitea OCI Registry Cross-Repo Blob Mount AuthZ Bypass (CVE-2026-117685) In Gitea’s OCI registry, cross-repository blob mounting validates the token’s public-only restriction on the target package but authorizes the source blob using the token owner’s full account permissions. A public-only token with write:package can mount a blob from a private package into a public namespace, exposing private container layers for public pull. 👉Affected: gitea.dev (OCI registry)

🚨High - Moto AWS Batch Emulation Privilege Escalation via privileged/volumes (CVE-2026-124501) Moto’s AWS Batch emulation in moto/batch/models.py improperly manages privileges when handling job definitions, allowing remote attackers to manipulate the privileged and volumes arguments to gain elevated container privileges and mount host paths. PoC exploit code is public; vendor has not responded. 👉Affected: moto <= 5.2.4

🚨Critical - Kubeflow Pipelines AuthZ Bypass via Empty Namespace Upload (CVE-2026-77596) Kubeflow Pipelines API server multi-user upload endpoints skip SubjectAccessReview when namespace=="" and REQUIRE_NAMESPACE_FOR_PIPELINES=false, returning early and bypassing authorization. A low-priv tenant (or unauthenticated caller if exposed without an auth proxy) can create shared pipelines or inject pipeline versions; unpinned recurring runs may execute the injected spec in another tenant’s namespace as that workload SA. 👉Affected: ghcr.io/kubeflow/kfp-api-ser… < 2.18.0 | Upgrade to 2.18.0

🚨Critical - Tracecat SAML Signature Validation Disabled via Empty Env Vars (CVE-2026-58490) In Tracecat Docker Compose deployments with SAML enabled, setting SAML_SIGNED_ASSERTIONS= and SAML_SIGNED_RESPONSES= disables signature requirements. An unauthenticated attacker can POST a forged unsigned SAMLResponse to the SAML assertion consumer endpoint for an existing user email to hijack sessions and potentially take over superadmin. Default Fargate and Helm deployments are not impacted. 👉Affected: Tracecat 0.37.0 to 1.0.0-beta.48 | Upgrade to 1.0.0-beta.49

🚨Critical - Contact Form 7 Unauth File Upload to RCE via Temp File Residue (CVE-2026-114432) Contact Form 7 before 6.2.4 fails to validate upload extensions and has a temporary upload cleanup flaw, letting unauthenticated attackers plant arbitrary files under wp-content/uploads. On Apache setups where .phar is executed by PHP (e.g., Debian/Ubuntu w/ directory listing), this can be triggered for RCE; otherwise it’s arbitrary file write/active content hosting. 👉Affected: Contact Form 7 < 6.2.4 | Upgrade to 6.2.4

🚨Critical - IBM Aspera Faspex Authorization Bypass to Admin (CVE-2026-123218) IBM Aspera Faspex 5.0.0-5.0.19 has an incorrect authorization flaw where an authenticated user can craft a specific message that bypasses authorization checks. Exploitation enables privilege escalation to full administrative access. 👉Affected: IBM Aspera Faspex 5.0.0-5.0.19