Daily Digest
Today's database vulnerability digest covers critical patches across MySQL, PostgreSQL, Oracle Database, and MongoDB. The single most urgent item is CVE-2026-85878, a critical CVSS 9.9 improper authorization flaw in Azure Database for PostgreSQL that allows authorized attackers to elevate privileges over a network. Additionally, Oracle has released a massive September security update addressing multiple high-severity RDBMS takeover vulnerabilities, and several open-source platforms relying on MySQL and PostgreSQL have disclosed severe SQL injection and denial-of-service flaws.
Summary: ITFlow prior to version 26.07 allows an authenticated user with module_support write permission to perform time-based blind SQL injection via the expires parameter in agent/ajax.php. This can expose sensitive data like password hashes and vault data, potentially leading to administrative takeover.
Affected Features / Interoperability: The share_generate_link handler in agent/ajax.php is impacted. Downstream functionality could include exposure of credential records, SMTP credentials, API keys, and encrypted vault data.
Source: https://github.com/itflow-org/itflow/commit/63d86917ae0438548d21d4e28e4d3c55176f5cbf, https://github.com/itflow-org/itflow/pull/1289, https://github.com/itflow-org/itflow/releases/tag/v26.07, https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h
Actions:
Summary: Vendure prior to 3.6.5 allows unauthenticated callers to cause denial of service via a catastrophically backtracking regex pattern through the public Shop GraphQL API. PostgreSQL and MySQL deployments do not execute the regex in the Node.js event loop, but better-sqlite3 and sqljs deployments are affected.
Affected Features / Interoperability: ShopProductsResolver.products and the list-query-builder component are impacted. Repeated requests can make the storefront and admin API unavailable.
Source: https://github.com/vendurehq/vendure/commit/f74cbbb0b9a50b5b0131822835fe7ee9b71b42c9, https://github.com/vendurehq/vendure/releases/tag/v3.6.5, https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7
Actions:
Summary: Keycloak deployed in stateless mode with MySQL or MariaDB has a mismatch in row-count semantics that allows an attacker to bypass replay protection. An attacker who intercepts single-use security artifacts like JWT client assertions or TOTP codes can replay them to gain unauthorized access.
Affected Features / Interoperability: The token endpoint and login flow are impacted. Downstream integrations relying on single-use tokens for authentication could be compromised.
Source: https://access.redhat.com/security/cve/cve-2026-90997, https://github.com/keycloak/keycloak
Actions:
Summary: Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning Craft is not installed, allowing unauthenticated attackers with a valid guest session to execute installer actions and disclose environment secrets. This requires an independently occurring database outage.
Affected Features / Interoperability: The install/validate-site action and Site::getName() are impacted. Downstream impacts include disclosure of Craft secrets, database credentials, and API keys.
Source: https://github.com/craftcms/cms/security/advisories/GHSA-hfjh-gw6x-7pv5, https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.13-environment-secret-exposure-via-installer
Actions:
Summary: MariaDB Connector/J prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 fails to enforce allowLocalInfile=false when processing server-initiated LOCAL INFILE packets. A rogue or MITM server can cause the connector to transmit a file selected by the application, requiring the application to actively load sensitive data over an untrusted connection.
Affected Features / Interoperability: ClientMessage.readPacket and LOCAL INFILE protocol handling are impacted. Downstream functionality includes potential exposure of local files to a malicious database server.
Source: https://github.com/mariadb-corporation/mariadb-connector-j/commit/0205d8be947918566cd9ce5a9db149541
Executive summary: The most urgent vulnerability in this digest is CVE-2026-75156 (CVSS 9.1, CRITICAL) — an incomplete fix in the Apache Airflow FAB provider leaves Azure AD OAuth login vulnerable to tenant-confusion attacks, allowing any unauthenticated attacker who can register an Azure tenant to log into the Airflow UI. No CISA KEV-confirmed entries appear in this digest; all items below are scored by CVSS severity alone. Five systems (Microsoft Azure, Kubernetes, Docker, and two others) carry formal vulnerability entries; AWS and GCP had news coverage only and are not included here.
Summary: Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Because signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, an `id_token` minted in any Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can authenticate to the Airflow UI with no prior access to the deployment. This is a follow-on to CVE-2026-59243 whose fix was incomplete; operators who already applied that fix are still affected and must upgrade again.
Affected Features / Interoperability: Airflow UI OAuth authentication when configured with Azure AD as an OAuth provider (FAB auth manager). Downstream impact: any workflow or integration relying on Airflow UI authentication and role-based authorization could be bypassed by an attacker impersonating any Azure AD identity.
Source:
Actions:
Summary: Omni manages Kubernetes on bare metal, VMs, or cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. An authenticated user with the Reader role can retrieve it if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters. Fixed in versions 1.6.6 and 1.7.3.
Affected Features / Interoperability: Talos cluster import flow in Omni; the exposed CA keys could compromise the entire imported cluster's PKI, affecting mutual TLS between components, API server authentication, and etcd encryption. Downstream integrations relying on the imported cluster's identity (e.g., CI/CD pipelines, monitoring agents) could be impersonated.
Source:
Actions:
Summary: MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, the default HTTP endpoint (port 8080) exposes an unauthenticated `get_resource` tool for pod logs that accepts attacker-controlled `limitBytes` and `tailLines` values parsed as unbounded int64 parameters. A remote attacker can send one request causing large allocations and response copies (observed: >1 GiB RSS for a 128 MiB requested stream), exhausting process memory and denying the MCP service. The request-frequency limiter does not constrain per-request volume. Fixed in version 0.4.1.
Affected Features / Interoperability: MKP's pod logs MCP tool (`pods logs` subresource). Any LLM agent or client relying on MKP for pod log retrieval could cause server crashes; the unauthenticated exposure means any network-reachable instance is vulnerable.
Source:
Actions:
Summary: Omni manages Kubernetes on bare metal, VMs, or cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in the SAML auth interceptor checks `SAMLAssertion.Used` and marks it used in separate state operations. Concurrent requests carrying the same captured SAML session token can each observe the assertion as unused and authenticate as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, create multiple persistent credentials tied to the victim via ConfirmPublicKey, and generate audit entries attributed to the victim. Fixed in versions 1.6.6 and 1.7.3.
Affected Features / Interoperability: SAML-based authentication in Omni. Downstream impact: an attacker gaining the victim's SAML token can escalate to the victim's privileges, create persistent credentials, and tamper with audit trails, potentially affecting confidentiality, integrity, and availability of the managed cluster.
Source:
Actions:
Summary: Omni manages Kubernetes on bare metal, VMs, or cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic passes the caller-controlled `TalosVersion` field to `imageFactoryClient.OverlaysVersions` without validating it as a version. An authenticated Operator can submit path traversal segments in `TalosVersion`, and `url.URL.JoinPath` normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. Fixed in versions 1.6.6 and 1.7.3.
Affected Features / Interoperability: Omni's schematic creation flow and image factory integration. The impact is limited to same-host endpoint probing and potential internal diagnostics disclosure; no remote code execution or data exfiltration is indicated.
Source:
Actions:
Summary: Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in `pkg/uprobetracer/usdt.go` can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a `SEC("usdt/...")` eBPF section attaches to a crafted ELF binary. The parser reads the `.note.stapsdt` section without validating `DescSize`, allowing an out-of-bounds slice operation to panic, and uses untrusted `NameSize`/`DescSize` for allocations that can consume gigabytes of memory. Only deployments using custom USDT gadgets are affected; no shipped gadget uses USDT probes. Impact is denial of service only — no code execution or privilege escalation demonstrated. Fixed in version 0.53.1.
Affected Features / Interoperability: Inspektor Gadget's USDT probe tracing capability when using custom gadgets. The privileged Gadget process crash affects all eBPF-based inspection workflows running on the host or cluster.
Source:
Actions:
Summary: Dockge validates a stack name only on the write path. The socket handlers confirm the caller is logged in and that the name is a string, then pass it straight to `Stack.getStack`, which builds a path with no validation. A name containing traversal sequences resolves outside the managed stacks directory. An authenticated user can therefore read the `composeENV` and `composeYAML` values of any directory the server process can reach (disclosing secrets in `.env` or Compose files), and can invoke `delete()` which runs `docker compose down` and then recursively force-removes the traversed path. Dockge commonly runs as root with access to the Docker socket, so the reachable set includes unrelated host applications. Instances configured with `disableAuth` expose both operations without authentication.
Affected Features / Interoperability: Dockge's stack management (read and delete operations on Docker Compose stacks). Because Dockge typically runs as root with Docker socket access, the traversal can reach any directory on the host, potentially exposing secrets for all containers and compromising the Docker daemon itself.
Source:
Actions:
Summary: Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where `workflow_dispatch` inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like `tag_version` and `node_version` to execute arbitrary commands and steal AWS credentials and Docker Hub tokens.
Affected Features / Interoperability: Flowise's CI/CD Docker image build pipeline triggered via `workflow_dispatch`. Compromised build agents can leak cloud credentials stored in the build environment, leading to broader cloud infrastructure compromise.
Source:
Actions:
Summary: Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query `GET /api/v1/infraproviders` with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.
Affected Features / Interoperability: Harness infrastructure provider configuration API. Leaked Docker endpoints and TLS paths could enable lateral movement; cloud project identifiers could be used to scope further attacks against cloud accounts.
Source:
Actions:
Summary: crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to `element.innerHTML`. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from `sessionStorage` for authenticated API abuse.
Affected Features / Interoperability: crawl4ai Docker Playground UI. An attacker who lures a user to a crafted PDF can hijack their API session, leading to unauthorized API calls under the victim's credentials.
Source:
Actions:
Summary: Kiwi TCMS is an open source test management system. Prior to 16.1, `TestCase.extra_link` and `TestPlan.extra_link` accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null.
Affected Features / Interoperability: Kiwi TCMS test case and test plan link fields. Exploitation is mitigated by default CSP headers in official Docker images; risk is limited to customized deployments with relaxed CSP policies.
Source:
Actions: