Daily Digest
The most urgent database-related issue is the Vitess debug endpoint cross‑site scripting flaw (CVE‑2026-104252, CVSS 9.8 CRITICAL), which allows a remote unauthenticated attacker to inject scripts that can read sensitive diagnostic data from exposed vttablet endpoints; immediate patching to Vitess 23.0.5 or 24.0.2 is advised.
Summary: Vitess versions before 23.0.5 and 24.0.2 reflect unsanitized user input from the `/twopcz` HTTP debug endpoint into HTML responses. An unauthenticated attacker can craft a request that executes JavaScript in the operator’s browser, allowing theft of same‑origin diagnostic data such as queries, transactions, and environment variables.
Affected Features / Interoperability: The `twopczHandler` in the Vitess tablet server’s debug endpoint is impacted; exposure of this endpoint can compromise internal diagnostics and potentially lead to further credential or data leakage.
Source:
Actions:
Summary: Wheels versions 1.1.8 through 4.1.1 improperly handle escaped single quotes in dynamic finder and query‑builder APIs, enabling SQL injection when application‑supplied data is reused as SQL. Attackers can bypass authentication, password‑reset, or token‑lookup protections and access or modify data without authorization.
Affected Features / Interoperability: The dynamic finder methods (e.g., `findOneByEmail`), query‑builder `where()` clauses, and key‑based lookup/validation functions are affected; any downstream functionality that relies on these APIs (user login, password reset, API token validation) could be compromised.
Source:
Actions:
Summary: The EmployeeRecruitmentSystem’s `mysql_query` call in `source/authprocessing.php` uses the `fpemail` parameter without sanitization, permitting remote SQL injection via the forgot‑password handler. The product lacks versioning and is unsupported, so no official patches exist.
Affected Features / Interoperability: The forgot‑password authentication flow is impacted; exploitation could lead to credential bypass, unauthorized access to recruitment data, or further database manipulation.
Source:
Actions:
Summary: The Vert.x MySQL client pre‑allocates memory for column definitions based on an unverified server‑declared count. A malicious or compromised MySQL server (or MITM) can send an excessively large column count, triggering a massive heap allocation that crashes the client with an OutOfMemoryError, causing denial of service.
Affected Features / Interoperability: The `io.vertx:vertx-mysql-client` component is affected; any Vert.x application relying on this client for database connectivity could lose all database connections and associated services.
Source:
Actions:
Summary: The Vert.x MySQL message decoder accumulates inbound packets without a size limit, allowing a malicious or compromised server to stream maximum‑sized packets and exhaust client memory, leading to an OutOfMemoryError before authentication completes.
Affected Features / Interoperability: Impacts the `io.vertx:vertx-mysql-client` component; any Vert.x‑based application using this client could suffer a total loss of database connectivity and dependent services.
Source:
Actions:
Summary: PostgreSQL versions prior to the listed patches allow a database superuser to replace the log file name with a symlink; when root starts the server, the privileged open/chmod/chown operations on the symlink enable the superuser to escalate to root privileges on the host OS.
Affected Features / Interoperability: The database startup script’s log‑file handling is affected; exploitation could lead to full host compromise, jeopardizing all services running on the server, including other databases, applications, and backup systems.
Source:
Actions:
Summary: A race condition in the Better Auth PostgreSQL adapters allows concurrent requests to bypass rate‑limiting checks, enabling attackers to exceed configured limits on sign‑in, 2FA, OTP, and password‑reset endpoints.
Affected Features / Interoperability: The database‑backed rate‑limiting logic in `@better-auth/drizzle-adapter`, `better-auth`, and `@better-auth/kysely-adapter` is impacted; any application relying on these adapters for authentication throttling could experience credential‑stuffing or denial‑of‑service via excessive request volume.
Source:
Actions:
Summary: The Vert.x PostgreSQL client’s binary array decoder allocates a Java array based on an unchecked 32‑bit dimension count from the server. A malicious or compromised PostgreSQL server (or MITM) can send an excessively large dimension value, causing a multi‑gigabyte heap allocation and an OutOfMemoryError that crashes the client.
Affected Features / Interoperability: Impacts the `io.vertx:vertx-pg-client` component; any Vert.x application using this client could lose all PostgreSQL connectivity and dependent services.
Source:
Actions:
Summary: The Vert.x PostgreSQL message decoder reads the 4‑byte length field without upper‑bound validation, allowing a malicious or compromised server to send an arbitrarily large length value and cause unbounded memory accumulation, leading to an OutOfMemoryError before authentication.
Affected Features / Interoperability: Affects the `io.vertx:vertx-pg-client` component; any Vert.x‑based application relying on this client could suffer a total loss of PostgreSQL connectivity and related services.
Source:
Actions:
The most urgent issue is the authorization bypass in Microsoft Azure Active Directory B2C (CVE-2026-83711), which carries a CVSS score of 10.0 and allows an unauthenticated attacker to elevate privileges over the network without any authentication, posing an immediate risk to identity‑dependent workloads in the healthcare cloud environment.
Summary: Authorization bypass through a user‑controlled key in Azure AD B2C lets an unauthenticated attacker elevate privileges by manipulating the key over the network; no authentication is required.
Affected Features / Interoperability: Azure AD B2C authorization logic; impacts any application relying on B2C for user authentication and could undermine IAM policies, conditional access, and federated trust.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83711
Actions:
Summary: Argo CD creates PostDelete resource hooks without applying AppProject destination and resource authorization checks, enabling a user with write access to an Application’s Git repository to inject a delete hook that creates forbidden resources with the controller’s cluster credentials.
Affected Features / Interoperability: Argo CD PostDelete hook processing; affects cluster‑scoped and namespaced resources managed by Argo CD, potentially allowing privilege escalation and unauthorized workload deployment.
Source: https://github.com/argoproj/argo-cd/commit/1149cdc6e932208c4402183cc3d7b7485239940c, https://github.com/argoproj/argo-cd/commit/4bc8085b0a6d2296b849539d3d09fc7be7a4a511, https://github.com/argoproj/argo-cd/commit/7f0a05834b05103d69d7c150e1ee36541b314696, https://github.com/argoproj/argo-cd/commit/d5dd7019ee65be8895133fe4df554e28074242c4, https://github.com/argoproj/argo-cd/releases/tag/v3.3.15
Actions:
Summary: In KEDA ≤2.20.2, a namespace admin who can create TriggerAuthentication and ScaledObject resources can point hashicorpVault.address at a tenant‑controlled endpoint; KEDA then sends the operator pod’s projected ServiceAccount token to that endpoint, allowing the attacker to inherit the operator’s cluster‑wide permissions.
Affected Features / Interoperability: KEDA Vault authentication integration; impacts any autoscaling workloads that rely on KEDA‑Vault integration, potentially leading to secret exposure and unauthorized cluster actions.
Source: https://github.com/kedacore/keda/commit/1e21cc798dedd079e696cdb45388eddc5e18365d, https://github.com/kedacore/keda/releases/tag/v2.21.0, https://github.com/kedacore/keda/security/advisories/GHSA-637c-6jxx-4rwm
Actions:
Summary: A low‑privileged Kubernetes user can inject arbitrary Jinja2 expressions into a custom resource spec that is processed by an Ansible Operator without sanitization, leading to remote code execution and privilege escalation via the operator’s service account.
Affected Features / Interoperability: Ansible Operator Plugins; affects any operator using Ansible for Kubernetes resource management, potentially enabling full cluster compromise.
Source: https://access.redhat.com/security/cve/CVE-2026-92982, https://bugzilla.redhat.com/show_bug.cgi?id=2522227
Actions:
Summary: Argo Workflows versions ≤3.6.13 and 3.7.0‑3.7.4 mishandle symbolic links during untar, allowing an attacker to overwrite /var/run/argo/argoexec with a malicious script that runs with the workflow pod’s privileges when the workflow starts.
Affected Features / Interoperability: Argo Workflows executor’s archive handling; impacts any workflow that processes untrusted archives, potentially leading to host‑level code execution.
Source: https://github.com/advisories/GHSA-p84v-gxvw-73pf, https://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037, https://github.com/argoproj/argo-workflows/commit/6b92af23f35aed4d4de8b04adcaf19d68f006de1, https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vh, https://github.com/advisories/GHSA-p84v-gxvw-73pf
Actions:
-