Daily Digest
The most urgent issue is CVE-2026-87016 in Open WebUI (a PostgreSQL-integrated AI platform), where a high-severity OAuth/SCIM wildcard injection vulnerability could allow session hijacking of administrator accounts, though PostgreSQL deployments themselves are unaffected. Additionally, MongoDB faces a denial-of-service risk via query planning integer overflow, and MySQL has an authorization bypass in Froxlor's API that could let customers access unauthorized database servers.
Summary: An OAuth subject containing wildcard characters (e.g., `%` or `_`) in Open WebUI's authentication flow could resolve to unintended user identities, including administrators, enabling session hijacking. PostgreSQL deployments are explicitly stated as unaffected. Exploitation requires network access to the Open WebUI service and a malicious OAuth provider.
Affected Features / Interoperability: The `get_user_by_oauth_sub` and `get_user_by_scim_external_id` functions in the user model, impacting OAuth and SCIM-based user provisioning integrations. PostgreSQL databases connected to Open WebUI are not directly vulnerable.
Source:
Actions:
Summary: An authenticated user with read/write privileges can craft queries that trigger an integer overflow in query planning, causing unbounded memory consumption and server termination. This denial-of-service affects all databases on the compromised node.
Affected Features / Interoperability: The query planning component of MongoDB Server. Replication and client drivers may fail if the primary node crashes during exploitation.
Source:
Actions:
Summary: Froxlor's `Mysqls.add` API command fails to validate the `mysql_server` parameter against customer allowlists, enabling attackers to provision databases on unauthorized servers. Exploitation requires API access with customer-level credentials.
Affected Features / Interoperability: The Froxlor API's MySQL server provisioning functionality. Breaks multi-tenant isolation in hosted database environments.
Source:
Actions:
Executive Summary: No CISA KEV-confirmed entries are present in today's Cloud Security batch, making CVE-2024-21400 (CVSS 9.0 CRITICAL) affecting Azure Kubernetes Service Confidential Containers the most urgent item due to its critical severity; remaining entries include a high-severity Azure CLI command injection, an OpenTelemetry Operator privilege escalation, and two Docker-related flaws (LangBot WebSocket auth bypass and Apache Storm worker-launcher command injection), all requiring prompt attention.
Summary: Elevation of privilege vulnerability in Azure Kubernetes Service Confidential Containers. The provided data does not detail the exact trigger or authentication requirements beyond affecting confidential container workloads on AKS.
Affected Features / Interoperability: AKS confidential container isolation and tenant workload boundaries; downstream impact on regulated healthcare data separation if clusters are compromised.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21400
Actions:
Summary: Command injection in Azure CLI via improper neutralization of special elements, allowing an authorized attacker to execute code over the network.
Affected Features / Interoperability: Azure CLI automation, CI/CD pipelines, and any infrastructure-as-code tooling invoking Azure CLI.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83948
Actions:
Summary: Elevation of privilege vulnerability in Azure Kubernetes Service Confidential Containers (duplicate entry under Kubernetes).
Affected Features / Interoperability: AKS confidential container workloads; cluster-level isolation and compliance boundaries.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21400
Actions:
Summary: OpenTelemetry Operator preserves ServiceMonitor bearerTokenFile as HTTPClientConfig.Authorization.CredentialsFile, letting a tenant point it at a Collector pod file (e.g., service-account token) and have the Collector send its contents as bearer auth on scrapes. Requires Collector service-account token or sensitive file mounted and Collector reaching the target.
Affected Features / Interoperability: OpenTelemetry Collector scraping, ServiceMonitor CRDs, bearer token propagation, and downstream telemetry integrity.
Source: https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5
Actions:
Summary: LangBot plugin runtime starts a debug WebSocket server on 0.0.0.0:5401 with plugin_debug_key defaulting to empty string and never set, skipping authentication entirely. Any remote attacker can register arbitrary debug plugins, intercept IM messages, inject replies, send messages as bots, enumerate UUIDs, invoke LLMs, read knowledge bases, and register malicious tools. No patched version was available at publication.
Affected Features / Interoperability: LangBot plugin runtime, instant messaging message handling, LLM pipelines, and knowledge-base contents.
Source: https://github.com/langbot-app/LangBot/security/advisories/GHSA-m7qm-2mjr-2h4q
Actions:
Summary: Apache Storm worker-launcher changes ownership of the worker directory before reading the command file, allowing a tenant to rewrite contents between the ownership change and read; the parsed command executes as root with host filesystem access, and mount validation is structural only.
Affected Features / Interoperability: Docker and OCI worker isolation, host filesystem bind mounts, topology submission, and container privilege boundaries.
Source: https://lists.apache.org/thread/8d5pkn486p8vrz5klg6onk5r8k9sd9lv
Actions:
Unverified chatter — separate from formal vulnerabilities above.
AWS