Daily Digest
The most urgent item is CVE-2026-85878 in Azure Database for PostgreSQL (CVSS 9.9 CRITICAL), an improper authorization flaw allowing an authenticated attacker to elevate privileges over the network. No CISA KEV-confirmed exploits appear in today's feed; the next-highest severities are MySQL CVE-2025-67510 (9.4) and two Microsoft SQL Server issues (8.4/8.3) tied to insecure defaults in NMIS/BioDose medical deployments.
Summary: The Neuron PHP framework's `MySQLWriteTool` (versions ≤2.8.11) executes arbitrary SQL supplied by an LLM/agent caller via `PDO::prepare()` without semantic restrictions. Prompt injection or indirect prompt manipulation can trigger destructive queries (DROP, TRUNCATE, DELETE, ALTER, privilege statements) subject to the DB user's permissions. Deployments exposing an agent with this tool to untrusted input and/or using a highly privileged DB account are impacted.
Affected Features / Interoperability: Neuron AI framework's `MySQLWriteTool` component; any LLM agent workflow that accepts untrusted prompts and connects to MySQL/MariaDB. Downstream impact includes potential data destruction, schema alteration, and privilege escalation within the database.
Source: https://github.com/neuron-core/neuron-ai/commit/44bab85d92bf162898ee48d0bcef6ba0d29b59c9, https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12, https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-898v-775g-777c
Actions:
Summary: Neuron's `MySQLSelectTool` (≤2.8.11) validates only the first keyword (e.g., SELECT) and a forbidden-keyword blocklist, which fails to block `INTO OUTFILE` / `INTO DUMPFILE` constructs. An attacker influencing tool input (e.g., via prompt injection) can write arbitrary files to the DB server if the MySQL/MariaDB account holds the `FILE` privilege and server configuration permits writes to accessible locations (e.g., web root).
Affected Features / Interoperability: Neuron AI framework's `MySQLSelectTool`; MySQL/MariaDB `FILE` privilege and `secure_file_priv` configuration. Downstream impact: arbitrary file write on the database host, potential web-shell deployment.
Source: https://github.com/neuron-core/neuron-ai/commit/72735d0ea133266cf2f5d5d195d41e9dd865289a, https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12, https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-j8g6-5gqc-mq36
Actions:
Summary: Budibase (<3.45.0) builds MySQL/MSSQL column-rename DDL by interpolating identifiers directly into raw query strings without using the project's quoting helpers. An attacker with DDL rights on a connected datasource can create a column name containing a backtick (MySQL) or single quote (MSSQL) plus injected SQL; when a builder later renames that column via the UI, the embedded quote terminates the identifier and the injected SQL executes. MySQL connections use `multipleStatements: true`, enabling stacked statements as the datasource user.
Affected Features / Interoperability: Budibase backend-core SQL table rename logic (`sqlTable.ts`); MySQL and MSSQL datasources. Downstream impact: arbitrary read/write/destructive operations on the connected database outside Budibase's permission model.
Source: https://github.com/Budibase/budibase/security/advisories/GHSA-ppj8-hmx2-m546, https://www.vulncheck.com/advisories/budibase-before-3.45.0-sql-injection-via-column-rename-ddl
Actions:
Summary: Adminer 5.5.1–6.0.1 improperly parses the login `server` string in `host_port()`. The port regex requires pure digits at string end; a non-digit tail causes fallback to the whole string as host with empty port. The privileged-port check inspects only the parsed port, so it is bypassed. The MySQL client then re-parses `host:port` from the host string, allowing a remote unauthenticated attacker to submit values like `127.0.0.1:80/x` and make the server initiate TCP connections to arbitrary internal hosts/ports before authentication — enabling SSRF and blind internal port scanning.
Affected Features / Interoperability: Adminer login page `server` field parsing; MySQL/mysqli client connection logic. Downstream impact: internal network reconnaissance, access to privileged ports, potential pivot to internal services.
Source: https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj, https://www.vulncheck.com/advisories/adminer-before-6.0.2-privileged-port-ssrf-via-host-port-regex
Actions:
Summary: Nuclei vulnerability scanner (3.0.0–3.10.0) does not enforce the local-file sandbox when a JavaScript template supplies the `allowAllFiles` MySQL DSN option. An untrusted JavaScript template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue `LOAD DATA LOCAL INFILE` requests for arbitrary paths; the scanner's client reads the files and returns contents even with `-allow-local-file-access` disabled. JavaScript templates can run unsigned without `-code` flag on affected versions.
Affected Features / Interoperability: Nuclei `nuclei/mysql` JavaScript library; CLI and SDK deployments accepting untrusted templates. Downstream impact: arbitrary file read from the scanner host filesystem.
Source: https://github.com/projectdiscovery/nuclei/commit/9611926a9a1ca99e8ed554d1b26fbeff60e06368, https://github.com/projectdiscovery/nuclei/pull/7473, https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0, https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-xhmx-w2j4-rw3q
Actions:
Summary: The `mysqlnd` wire protocol parser reads fields from server packets before verifying the packet contains enough bytes. A malicious or compromised MySQL server can send a truncated packet, causing the client to read past the buffer end — undefined behavior that can crash the client process.
Affected Features / Interoperability: PHP `mysqlnd` driver (used by `mysqli`, `PDO_MySQL`). Downstream impact: client-side denial of service when connecting to a malicious/compromised server.
Source: https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7
Actions:
Summary: Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over the network. Details are sparse in the Microsoft advisory; the flaw likely involves insufficient permission checks on a privileged operation accessible to authenticated users.
Affected Features / Interoperability: Azure Database for PostgreSQL managed service. Specific feature/module not disclosed in the advisory. Downstream impact: potential full control over the PostgreSQL instance, data access, and further cloud resource compromise.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85878
Actions:
Summary: pgPointcloud ≤1.2.5 contains a heap out-of-bounds read in dimensional patch WKB deserialization. Authenticated database users can supply crafted `pcpatch` values with attacker-controlled size fields to copy adjacent heap memory into stored patches for exfiltration or crash the PostgreSQL backend.
Affected Features / Interoperability: pgPointcloud extension (point cloud data type); WKB deserialization code path (`pc_bytes.c`). Downstream impact: memory disclosure (potential secrets/keys in heap), backend crash (DoS).
Source: https://github.com/pgpointcloud/pointcloud, https://github.com/pgpointcloud/pointcloud/blob/v1.2.5/lib/pc_bytes.c#L1347-L1373, https://github.com/pgpointcloud/pointcloud/issues/387, https://github.com/pgpointcloud/pointcloud/pull/388, https://www.vulncheck.com/advisories/pgpointcloud-through-1.2.5-heap-out-of-bounds-read-via-wkb-deserialization
Actions:
Summary: Capgo (capgo.app) ≤12.261.0 has an incomplete access-control fix for `public.sso_providers`. A migration installs a BEFORE UPDATE guard freezing only `dns_verified_at`, `domain`, `status`, `enforce_sso` — leaving `provider_id`, `metadata_url`, `attribute_mapping` writable. The table grants ALL to `anon`/`authenticated` roles; RLS policies constrain rows but not columns. An `org_admin` can PATCH `provider_id` via PostgREST to an IdP they control, then authenticate as the org owner, triggering account takeover and lockout of the legitimate owner. Requires target org to have active SSO and attacker to hold `org_admin`. No patched version available.
Affected Features / Interoperability: Capgo `sso_providers` table, PostgREST API, RLS policies. Downstream impact: vertical privilege escalation, account takeover, session invalidation for legitimate owner.
Source: https://github.com/Cap-go/capgo.app/security/advisories/GHSA-jpjp-v827-j4gc, https://www.vulncheck.com/advisories/capgo-sso-provider-id-authentication-bypass-via-incomplete-migration
Actions:
Summary: PostgreSQL Anonymizer allows unprivileged masked users to repeatedly call `anon.hash()` and collect (seed, hash_output) pairs to perform offline brute-force and deduce the salt. A masked role can execute a RESTRICTED function when the call is placed inside a sub-select. Fixed in version 3.2.3+.
Affected Features / Interoperability: PostgreSQL Anonymizer extension `anon.hash()` function; dynamic masking / anonymization workflows. Downstream impact: salt recovery undermines pseudonymization guarantees.
Source: https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/685
Actions:
Summary: NMIS/BioDose V22.02 and earlier installations using embedded Microsoft SQL Server Express expose the SQL Server directory via a Windows share accessible to network clients. The directory has insecure default paths allowing access to database and configuration files containing sensitive data.
Affected Features / Interoperability: NMIS/BioDose medical software installations with embedded SQL Server Express; Windows file sharing (SMB). Downstream impact: unauthorized access to PHI, database credentials, configuration secrets.
Source: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01
Actions:
Summary: NMIS/BioDose V22.02 and earlier default the SQL user `nmdbuser` (and other created accounts) to the `sysadmin` role. This enables remote code execution via built-in stored procedures (e.g., `xp_cmdshell`).
Affected Features / Interoperability: NMIS/BioDose SQL Server database accounts; SQL Server `sysadmin` role and extended stored procedures. Downstream impact: full OS command execution as the SQL Server service account.
Source: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01
Actions:
Summary: An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension (≤4.18.1) occurs when encoding a single document from unusually large caller-supplied data. Size arithmetic uses a signed 32-bit type; the overflow guard has undefined behavior per C standard. An unprivileged party who can place a very large value into application-encoded data may cause an out-of-bounds write in the application process.
Affected Features / Interoperability: MongoDB Python Driver (`pymongo`) native extension BSON encoder. Downstream impact: potential remote code execution or process crash in applications encoding attacker-controlled data.
Source: https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst, https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2, https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv
Actions:
Summary: MongoDB Server's Queryable Encryption maintenance operations insufficiently validate internal metadata references, allowing an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data in a different collection.
Affected Features / Interoperability: MongoDB Queryable Encryption feature; encrypted collection maintenance operations. Downstream impact: cross-collection data corruption/destruction, bypassing encryption isolation guarantees.
Source: https://jira.mongodb.org/browse/SERVER-130633
Actions:
Summary: MongoDB Server's query execution engine has a use-after-free when running certain queries against time-series collections. An authenticated user with read/write privileges can trigger an internal reference to be used after memory is freed, causing server crash or disclosure of freed memory contents in query results.
Affected Features / Interoperability: MongoDB time-series collections query execution. Downstream impact: denial of service (server crash), potential memory disclosure (sensitive data in freed buffers).
Source: https://jira.mongodb.org/browse/SERVER-130247
Actions:
Summary: A MongoDB driver component writes sensitive configuration (including a credential for outbound network connectivity) to application logs in cleartext during routine client initialization. No special privileges needed to trigger. Anyone with log access (application logs, log aggregation) can recover the credential and reuse it to authenticate to associated network infrastructure.
Affected Features / Interoperability: MongoDB driver client initialization logging; outbound credential handling. Downstream impact: credential leakage, potential lateral movement to network infrastructure.
Source: https://jira.mongodb.org/browse/JAVA-6266
Actions:
Unverified chatter — not authoritative vulnerability data.
The most urgent item is CVE-2025-57870, a critical (CVSS 10.0) SQL injection flaw in Esri ArcGIS Server running on Kubernetes that allows unauthenticated remote attackers to execute arbitrary SQL commands against the underlying Enterprise Geodatabase, posing an immediate risk of data breach or manipulation.
Summary: Zammad’s “Automatic account link on initial logon” feature binds an incoming SSO identity to a local account by matching the email address provided by the identity provider without verifying that the provider actually confirmed ownership of that email. An attacker who controls any identity at a configured SSO provider (including Azure AD via Zammad’s multi-tenant Microsoft 365 /common app registration) can set that identity’s email to a victim’s address, authenticate, and log in as the victim, bypassing local password protection. This affects any existing Zammad account, including agents and administrators, and is fixed in Zammad 7.1.2.
Affected Features / Interoperability: The SSO automatic account linking feature is impacted, potentially allowing unauthorized access to Zammad and any integrated services or data accessed through it.
Source:
Actions:
Summary: Esri ArcGIS Server versions 11.3, 11.4, and 11.5 on Windows, Linux, and Kubernetes contain a SQL injection vulnerability in a specific ArcGIS Feature Service operation. A remote, unauthenticated attacker can send crafted requests to execute arbitrary SQL commands, potentially leading to unauthorized access, modification, or deletion of data in the underlying Enterprise Geodatabase.
Affected Features / Interoperability: The ArcGIS Feature Service operation is affected; exploitation could allow attackers to read, modify, or delete geospatial data, break dependent applications, and compromise any downstream services consuming the geodatabase.
Source:
Actions:
Summary: In Kyverno versions 1.14.0 through 1.19.0, the ImageValidatingPolicy evaluator ignores the spec.images and spec.allowedValues fields of a PolicyException resource. Consequently, any PolicyException that matches a resource causes image signature verification to be skipped for all images on that resource, rather than only the specified images, allowing unsigned or untrusted container images to be admitted to the cluster. The issue is resolved in Kyverno 1.19.1.
Affected Features / Interoperability: Kyverno’s ImageValidatingPolicy admission control is bypassed, potentially permitting unverified container images to run in the cluster and undermining image-signing enforcement for workloads that rely on it.
Source:
Actions:
Summary: The OpenTelemetry Operator prior to version 0.152.0 incorrectly preserves a ServiceMonitor’s bearerTokenFile value (including the Kubernetes service-account token) as an HTTP client credential when targetAllocator.prometheusCR.enabled is true. A tenant who can create or update a matching ServiceMonitor can point bearerTokenFile at any file in the Collector pod and direct scraping to a tenant-controlled endpoint, leading to disclosure of the Collector’s service-account JWT or other mounted files. The flaw is fixed in version 0.152.0.
Affected Features / Interoperability: The OpenTelemetry Operator’s TargetAllocator component and its handling of ServiceMonitor bearerTokenFile are affected; exploitation could lead to credential leakage and unauthorized Kubernetes API access based on the Collector’s service account permissions.
Source:
Actions:
Summary: Strimzi versions from 0.47.0 up to but not including 0.49.1 incorrectly create a Kubernetes Role that grants the Kafka Connect and MirrorMaker 2 components GET access to all Secrets in their namespace. This over‑permission can expose sensitive data such as credentials, TLS keys, or other secrets stored in Kubernetes Secrets. The issue is patched in Strimzi 0.49.1.
Affected Features / Interoperability: The Strimzi‑generated Role for Kafka Connect and MirrorMaker 2 is excessively permissive, risking secret exposure and potential compromise of any services relying on those secrets.
Source:
Actions:
Summary: Envoy Gateway versions prior to 1.7.4 and 1.8.1 lack validation of the backend namespace when processing an HTTPRoute with an extension‑managed custom backendRef. This allows a route in