Daily Digest
Today's Database digest highlights Warpgate's critical SSO endpoint vulnerability (CVE-2026-58491, CVSS 9.3) as the most urgent item due to its combination of stored XSS, open redirect, and admin API exposure in a bastion host that sits in front of MySQL; no CISA KEV-confirmed entries are present in the current formal feed, so all items remain theoretical severity. PostgreSQL's pg_partman privilege escalation (CVE-2026-61820, 8.5) and Spring Statemachine deserialization RCE affecting MongoDB backends (CVE-2026-41862, 8.8) follow as high-severity findings. Healthcare infrastructure owners should prioritize Warpgate and pg_partman patches, while homelab operators running Postgres/Vault/mTLS should verify pg_partman usage and review Keycloak replay protections.
Summary: Warpgate's SSO start endpoint stores an attacker-controlled `next` parameter without HTML escaping; the return handler inserts it into the response and uses it as a redirect destination, enabling stored XSS and open redirect after authentication.
Affected Features / Interoperability: Warpgate SSO provider API (`/@warpgate/api/sso/providers/:name/start`, `/@warpgate/api/sso/return`), session data, and administrator APIs when the victim is an admin. Raw data does not specify downstream integrations beyond the Warpgate origin.
Source: https://github.com/warp-tech/warpgate/commit/eab0548f018d95b5f96f8e913527000e05ed93a2, https://github.com/warp-tech/warpgate/releases/tag/v0.25.5, https://github.com/warp-tech/warpgate/security/advisories/GHSA-3c3w-75j2-7h74
Actions:
Summary: The pam_mysql module before 0.4.7 does not cleanse user input when constructing SQL statements, allowing attackers to obtain plaintext passwords or hashes.
Affected Features / Interoperability: PAM authentication module for MySQL. Raw data does not specify downstream replication or client driver impacts.
Source: http://archives.neohapsis.com/archives/bugtraq/2000-10/0374.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/5447
Actions:
Summary: Keycloak deployed in stateless mode with MySQL or MariaDB has a row-count semantics mismatch that allows replay of single-use security artifacts such as JWT client assertions, DPoP proofs, or TOTP codes.
Affected Features / Interoperability: Keycloak token endpoint and login flow when backed by MySQL/MariaDB. Raw data does not specify downstream integrations beyond the token endpoint.
Source: https://access.redhat.com/security/cve/CVE-2026-90997, https://bugzilla.redhat.com/show_bug.cgi?id=2533141
Actions:
Summary: MySQL Database Engine uses a weak authentication method that leaks information a remote attacker could use to recover the password.
Affected Features / Interoperability: MySQL authentication mechanism. Raw data does not specify downstream replication or client driver impacts.
Source: http://archives.neohapsis.com/archives/bugtraq/2000-10/0318.html, http://www.mysql.com/documentation/mysql/commented/manual.php?section=Security, https://exchange.xforce.ibmcloud.com/vulnerabilities/5409
Actions:
Summary: Restaurant Management System SQL injection in `mysqli_query` via the `table/members/price` argument in `admin/add_table.php`.
Affected Features / Interoperability: Admin add_table.php search form. Raw data does not specify downstream integrations.
Source: https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/3, https://vuldb.com/cve/CVE-2026-94042, https://vuldb.com/submit/948799, https://vuldb.com/vuln/407971, https://vuldb.com/vuln/407971/cti
Actions:
Summary: Restaurant Management System SQL injection in `mysqli_query` via the `s1` argument in `admin/display_menu.php` search form.
Affected Features / Interoperability: Admin display_menu.php search form. Raw data does not specify downstream integrations.
Source: https://github.com/AdithyaYelloju/Restaurant-Management-System/, https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/4, https://vuldb.com/cve/CVE-2026-95868, https://vuldb.com/submit/953178, https://vuldb.com/vuln/408542
Actions:
Summary: Craft CMS treats a database connection failure as not installed, exposing installer actions on production; an unauthenticated attacker with a valid guest session and CSRF token can submit a crafted site name to read environment variables, secrets,
One-paragraph executive summary, highlighting the single most urgent item (a CISA KEV-confirmed entry always outranks a merely high-CVSS entry, since it's confirmed exploitation vs. theoretical severity).
The most urgent cloud security issue this week is CVE‑2026‑92574, a flaw in CRI‑O’s checkpoint restore that lets a privileged user bypass the destination security context and run with elevated privileges; its CVSS score of 8.8 makes it the highest‑severity vulnerability in the current data set.
Summary: A flaw in CRI‑O’s checkpoint restore allows a user who can create a pod from a malicious checkpoint to bypass the destination security context, retaining credentials and capabilities, which can lead to privilege escalation across container boundaries. Exploitation requires the ability to create a pod from a malicious checkpoint image and have checkpoint restore enabled.
Affected Features / Interoperability: CRI‑O checkpoint restore functionality; can break pod security and enable cluster‑wide privilege escalation.
Source: https://access.redhat.com/security/cve/CVE-2026-92574, https://bugzilla.redhat.com/show_bug.cgi?id=2535436
Actions:
Summary: Capsule’s forbidden list sorting logic incorrectly handles case‑insensitive keys, allowing a tenant owner to bypass namespace and metadata restrictions. An authenticated tenant can craft a list with mixed‑case keys to evade the policy check.
Affected Features / Interoperability: Capsule multi‑tenancy policy enforcement; can affect namespace creation, network policies, and scheduling.
Source: https://github.com/projectcapsule/capsule/commit/755cef54bf4a1bc56d6692130132bc70755bef46, https://github.com/projectcapsule/capsule/pull/1982, https://github.com/projectcapsule/capsule/releases/tag/v0.13.7, https://github.com/projectcapsule/capsule/security/advisories/GHSA-gjw4-3v3v-rqxg
Actions:
Summary: A bug in Capsule’s Tenant validation compiles ForbiddenAnnotations.Regex for both labels and annotations, so a malformed annotation regex can cause a panic during later validation, blocking namespace operations.
Affected Features / Interoperability: Capsule Tenant management; can prevent namespace creation or updates for affected tenants.
Source: https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e, https://github.com/projectcapsule/capsule/pull/1983, https://github.com/projectcapsule/capsule/releases/tag/v0.13.7, https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3
Actions:
Summary: Gardener’s customverbauthorizer admission plugin fails to check Group or ServiceAccount subjects in Project.spec.members, allowing a project administrator lacking manage‑members permission to add privileged groups such as system:authenticated and gain broad cluster access.
Affected Features / Interoperability: Gardener project authorization; can lead to unauthorized access to Shoots, Secrets, and cloud provider credentials.
Source: https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545, https://github.com/gardener/gardener/pull/15080, https://github.com/gardener/gardener/releases/tag/v1.144.2, https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888
Actions:
Summary: Frigate’s nginx configuration permits unauthenticated viewer users to access the go2rtc API endpoint, exposing internal addresses, configuration files, logs, and RTSP stream URLs that may contain camera credentials.
Affected Features / Interoperability: Frigate web UI/API; can leak camera credentials and configuration data.
Source: https://github.com/blakeblackshear/frigate/commit/520d9eeb7f0fe46021f29fb8169741dd1d429271, https://github.com/blakeblackshear/frigate/pull/22735, https://github.com/blakeblackshear/frigate/releases/tag/v0.18.0, https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr
Actions:
Summary: A flaw in Sonatype Nexus Repository Manager’s format‑specific API key generation can let a remote attacker gain unauthorized access to repository operations as a targeted user when the API key realm is enabled and the user has an active key.
Affected Features / Interoperability: Nexus repository API key management; can compromise user operations.
Source: https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html, https://support.sonatype.com/hc/en-us/articles/52347011450515/
Actions:
Summary: An unauthenticated remote attacker can launch a denial‑of‑service attack against the Thinkst Canary Redis service when it is enabled.
Affected Features / Interoperability: Thinkst Canary Redis service.
Source: https://canary.tools/security-advisories/tc-2026-01.txt
Actions:
Summary: rclone’s docker volume plugin allows a volume name containing directory traversal characters to create directories outside the intended base path, enabling a privileged rclone process to mount arbitrary host filesystems.
Affected Features / Interoperability: rclone docker volume plugin; can lead to host filesystem compromise.
Source: https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6, https://www.vulncheck.com/advisories/rclone-serve-docker-path-traversal-via-volume-name, https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6
Actions:
Summary: An authorization bypass in Nexus Repository 3’s component upload API allows a user with read/browse privileges to upload arbitrary artifacts, bypassing the intended write permission check.
Affected Features / Interoperability: Nexus Repository component upload API; can enable unauthorized artifact uploads.
Source: https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html, https://support.sonatype.com/hc/en-us/articles/53137654741907
Actions: