Common Weakness Enumeration

CWE-525

Allowed

Use of Web Browser Cache Containing Sensitive Information

Abstraction: Variant · Status: Incomplete

API response cwe.mitre.org

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

64 vulnerabilities reference this CWE, most recent first.

GHSA-258C-CQQ8-PMRP

Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-04-07 03:30
VLAI
Details

Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.0 (Medium)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-15554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-16T14:17:56Z",
    "severity": "MODERATE"
  },
  "details": "Browser caching of LAPS passwords in Truesec\u2019s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords.",
  "id": "GHSA-258c-cqq8-pmrp",
  "modified": "2026-04-07T03:30:24Z",
  "published": "2026-03-16T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15554"
    },
    {
      "type": "WEB",
      "url": "https://labs.reversec.com/advisories/2026/03/admin-passwords-cached-by-browsers-in-truesec-lapswebui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-2Q58-H8F4-6Q55

Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20
VLAI
Details

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (All versions < V8.18.12), Mendix Applications using Mendix 9 (All versions < V9.6.1). Applications built with affected versions of Mendix Studio Pro do not prevent file documents from being cached when files are opened or downloaded using a browser. This could allow a local attacker to read those documents by exploring the browser cache.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-42015"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-09T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.26), Mendix Applications using Mendix 8 (All versions \u003c V8.18.12), Mendix Applications using Mendix 9 (All versions \u003c V9.6.1). Applications built with affected versions of Mendix Studio Pro do not prevent file documents from being cached when files are opened or downloaded using a browser. This could allow a local attacker to read those documents by exploring the browser cache.",
  "id": "GHSA-2q58-h8f4-6q55",
  "modified": "2022-05-24T19:20:09Z",
  "published": "2022-05-24T19:20:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42015"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-338732.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-4CWX-7WF7-3272

Vulnerability from github – Published: 2026-08-03 19:19 – Updated: 2026-08-03 19:24
VLAI
Summary
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
Details

Summary

Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js:

  1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.
  2. Parse-time crash: Mixed unqualified-and-qualified private directives in the same header (such as public, max-age=60, private, private="hdr") cause an uncaught TypeError in the cache-control parser, terminating the request.

Impact

Shared-cache disclosure

Applications using interceptors.cache() in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including Set-Cookie.

Required conditions:

  • the cache interceptor is enabled in shared mode, including the default configuration;
  • an upstream returns a malformed directive such as Cache-Control: public, max-age=300, private="";
  • another request later matches the same cache key, without a separating Vary header.

Parse-time crash

Applications using interceptors.cache() against an upstream that returns a Cache-Control header combining unqualified private with qualified private="..." see an uncaught TypeError: output.private.concat is not a function during response handling. The request rejects; depending on the consumer's error handling, the process may exit.

Details

private="" is parsed as { private: [''] }. The shared-cache guard only rejects private === true, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.

For the crash variant, an unqualified private directive sets output.private = true, then a subsequent qualified private="hdr" directive attempts output.private.concat(['hdr']), which throws because boolean has no concat method.

The patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to true and preserves existing true values, closing both vectors.

Patches

Upgrade to undici 7.29.0 or 8.9.0. Both releases fix the qualified private directive handling that caused the shared-cache storage and the parser crash.

Workarounds

Until patched, avoid shared interceptors.cache() for user-specific responses, use type: 'private', or disable caching for affected origins.

Credit

Disclosure variant reported by @h0rk1p via HackerOne report #3817497.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "undici"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "undici"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-13697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-248",
      "CWE-525"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-03T19:19:47Z",
    "nvd_published_at": "2026-07-29T17:16:50Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nTwo issues in undici\u0027s cache interceptor, both fixed by the same patch on `lib/util/cache.js`:\n\n1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=\"\"` or `private=\",\"` can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.\n2. **Parse-time crash:** Mixed unqualified-and-qualified `private` directives in the same header (such as `public, max-age=60, private, private=\"hdr\"`) cause an uncaught `TypeError` in the cache-control parser, terminating the request.\n\n### Impact\n\n#### Shared-cache disclosure\n\nApplications using `interceptors.cache()` in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including `Set-Cookie`.\n\nRequired conditions:\n\n- the cache interceptor is enabled in shared mode, including the default configuration;\n- an upstream returns a malformed directive such as `Cache-Control: public, max-age=300, private=\"\"`;\n- another request later matches the same cache key, without a separating `Vary` header.\n\n#### Parse-time crash\n\nApplications using `interceptors.cache()` against an upstream that returns a `Cache-Control` header combining unqualified `private` with qualified `private=\"...\"` see an uncaught `TypeError: output.private.concat is not a function` during response handling. The request rejects; depending on the consumer\u0027s error handling, the process may exit.\n\n### Details\n\n`private=\"\"` is parsed as `{ private: [\u0027\u0027] }`. The shared-cache guard only rejects `private === true`, so the response can be stored. When served from cache, the previous user\u0027s body and headers may be returned to a different user.\n\nFor the crash variant, an unqualified `private` directive sets `output.private = true`, then a subsequent qualified `private=\"hdr\"` directive attempts `output.private.concat([\u0027hdr\u0027])`, which throws because boolean has no `concat` method.\n\nThe patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to `true` and preserves existing `true` values, closing both vectors.\n\n### Patches\n\nUpgrade to `undici` 7.29.0 or 8.9.0. Both releases fix the qualified `private` directive handling that caused the shared-cache storage and the parser crash.\n\n### Workarounds\n\nUntil patched, avoid shared `interceptors.cache()` for user-specific responses, use `type: \u0027private\u0027`, or disable caching for affected origins.\n\n### Credit\n\nDisclosure variant reported by @h0rk1p via HackerOne report [#3817497](https://hackerone.com/reports/3817497).",
  "id": "GHSA-4cwx-7wf7-3272",
  "modified": "2026-08-03T19:24:25Z",
  "published": "2026-08-03T19:19:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13697"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451"
    },
    {
      "type": "WEB",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nodejs/undici"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/releases/tag/v7.29.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/releases/tag/v8.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives"
}

GHSA-5VQJ-7M73-9W2P

Vulnerability from github – Published: 2025-01-20 18:30 – Updated: 2025-01-20 18:30
VLAI
Details

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.

Severity
4.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-22349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-20T18:15:13Z",
    "severity": "MODERATE"
  },
  "details": "IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.",
  "id": "GHSA-5vqj-7m73-9w2p",
  "modified": "2025-01-20T18:30:49Z",
  "published": "2025-01-20T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22349"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7172750"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6533-FHR2-F38H

Vulnerability from github – Published: 2025-11-01 00:30 – Updated: 2025-11-15 02:24
VLAI
Summary
Liferay Portal and DXP use an incorrect cache-control header
Details

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.6 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay:com.liferay.adaptive.media.web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.52"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:com.liferay.portal.impl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "69.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62276"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-03T20:26:09Z",
    "nvd_published_at": "2025-11-01T00:15:33Z",
    "severity": "MODERATE"
  },
  "details": "The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser\u0027s cache.",
  "id": "GHSA-6533-fhr2-f38h",
  "modified": "2025-11-15T02:24:27Z",
  "published": "2025-11-01T00:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62276"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liferay/liferay-portal/commit/36c080fc4522e46d69b5c3b4b9eb6aca5ff52699"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liferay/liferay-portal/commit/9781b594cffcd23583a1a0f93746fd20e3eb55bd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/liferay/liferay-portal"
    },
    {
      "type": "WEB",
      "url": "https://liferay.atlassian.net/browse/LPE-17701"
    },
    {
      "type": "WEB",
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62276"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Liferay Portal and DXP use an incorrect cache-control header"
}

GHSA-6JQF-XC4J-4QG4

Vulnerability from github – Published: 2025-09-15 18:31 – Updated: 2025-09-15 18:31
VLAI
Details

IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.

Severity
4.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-36082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T16:15:37Z",
    "severity": "MODERATE"
  },
  "details": "IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.",
  "id": "GHSA-6jqf-xc4j-4qg4",
  "modified": "2025-09-15T18:31:06Z",
  "published": "2025-09-15T18:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36082"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7244777"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RCG-P8J5-6HQ6

Vulnerability from github – Published: 2024-07-19 03:30 – Updated: 2024-07-19 03:30
VLAI
Details

HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-30130"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-19T02:15:13Z",
    "severity": "LOW"
  },
  "details": "HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.",
  "id": "GHSA-6rcg-p8j5-6hq6",
  "modified": "2024-07-19T03:30:53Z",
  "published": "2024-07-19T03:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30130"
    },
    {
      "type": "WEB",
      "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0114184"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6VGG-XHVH-38FF

Vulnerability from github – Published: 2026-06-12 18:30 – Updated: 2026-06-12 18:30
VLAI
Summary
nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store
Details

internal/api/mobile_bundle.go:62-66 sets only Content-Type: application/yaml. The Web-UI sibling at internal/web/handlers.go:1316-1321 sets Cache-Control: no-store, Pragma: no-cache, Expires: 0, X-Content-Type-Options: nosniff — and has a test asserting it. The API path was missed.

Affected

All released versions up to v0.3.0.

Threat model

The endpoint returns a freshly minted X25519 private key inline. Without no-store, any intermediary proxy or CDN that caches 200 OK YAML responses retains the private key for its cache TTL. Same applies to browser disk cache for direct API hits. Combined with the cross-tenant authz advisory (critical), even a corrected authz layer would still leak via cache after fix.

Suggested fix

Copy the four headers from the Web sibling:

w.Header().Set("Content-Type", "application/yaml; charset=utf-8")
w.Header().Set("Cache-Control", "no-store")
w.Header().Set("Pragma", "no-cache")
w.Header().Set("Expires", "0")
w.Header().Set("X-Content-Type-Options", "nosniff")

Mirrors internal/web/handlers.go:1316-1321. Add a parallel test to the existing web-side coverage.

Suggested patch

Verified locally: go vet, go test -race -count=1 ./..., golangci-lint v2.12 all clean.

diff --git a/internal/api/mobile_bundle.go b/internal/api/mobile_bundle.go
index fc09da0..73152eb 100644
--- a/internal/api/mobile_bundle.go
+++ b/internal/api/mobile_bundle.go
@@ -58,8 +58,15 @@ func (s *Server) handleMobileBundle(w http.ResponseWriter, r *http.Request) {
        return
    }

-   // Return YAML bundle with proper content-type
+   // Return YAML bundle with proper content-type. The bundle inlines a
+   // freshly-minted X25519 private key, so suppress every layer of cache
+   // between server and operator (intermediate proxies/CDNs, browser disk
+   // cache). Mirrors the Web-UI sibling at internal/web/handlers.go.
    w.Header().Set("Content-Type", "application/yaml; charset=utf-8")
+   w.Header().Set("Cache-Control", "no-store")
+   w.Header().Set("Pragma", "no-cache")
+   w.Header().Set("Expires", "0")
+   w.Header().Set("X-Content-Type-Options", "nosniff")
    w.WriteHeader(http.StatusOK)
    if _, err := w.Write(bundle); err != nil {
        s.logger.Error("write mobile bundle response", "error", err)
diff --git a/internal/api/mobile_bundle_test.go b/internal/api/mobile_bundle_test.go
index dcb8cd9..da08b01 100644
--- a/internal/api/mobile_bundle_test.go
+++ b/internal/api/mobile_bundle_test.go
@@ -52,6 +52,19 @@ func TestHandleMobileBundle_Success(t *testing.T) {
        t.Errorf("Content-Type = %q, want 'application/yaml; charset=utf-8'", ct)
    }

+   // Bundle inlines a private key — every cache between server and operator
+   // must drop the response. Mirrors the Web-UI sibling's headers.
+   for header, want := range map[string]string{
+       "Cache-Control":         "no-store",
+       "Pragma":                "no-cache",
+       "Expires":               "0",
+       "X-Content-Type-Options": "nosniff",
+   } {
+       if got := w.Header().Get(header); got != want {
+           t.Errorf("%s = %q, want %q", header, got, want)
+       }
+   }
+
    // Verify body is valid YAML with expected keys
    var yamlData map[string]interface{}
    if err := yaml.Unmarshal(w.Body.Bytes(), &yamlData); err != nil {
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/juev/nebula-mesh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T18:30:09Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "`internal/api/mobile_bundle.go:62-66` sets only `Content-Type: application/yaml`. The Web-UI sibling at `internal/web/handlers.go:1316-1321` sets `Cache-Control: no-store`, `Pragma: no-cache`, `Expires: 0`, `X-Content-Type-Options: nosniff` \u2014 and has a test asserting it. The API path was missed.\n\n## Affected\nAll released versions up to v0.3.0.\n\n## Threat model\nThe endpoint returns a freshly minted X25519 private key inline. Without `no-store`, any intermediary proxy or CDN that caches `200 OK` YAML responses retains the private key for its cache TTL. Same applies to browser disk cache for direct API hits. Combined with the cross-tenant authz advisory (critical), even a corrected authz layer would still leak via cache after fix.\n\n## Suggested fix\nCopy the four headers from the Web sibling:\n\n```go\nw.Header().Set(\"Content-Type\", \"application/yaml; charset=utf-8\")\nw.Header().Set(\"Cache-Control\", \"no-store\")\nw.Header().Set(\"Pragma\", \"no-cache\")\nw.Header().Set(\"Expires\", \"0\")\nw.Header().Set(\"X-Content-Type-Options\", \"nosniff\")\n```\n\nMirrors `internal/web/handlers.go:1316-1321`. Add a parallel test to the existing web-side coverage.\n\n## Suggested patch\n\nVerified locally: `go vet`, `go test -race -count=1 ./...`, `golangci-lint v2.12` all clean.\n\n```diff\ndiff --git a/internal/api/mobile_bundle.go b/internal/api/mobile_bundle.go\nindex fc09da0..73152eb 100644\n--- a/internal/api/mobile_bundle.go\n+++ b/internal/api/mobile_bundle.go\n@@ -58,8 +58,15 @@ func (s *Server) handleMobileBundle(w http.ResponseWriter, r *http.Request) {\n \t\treturn\n \t}\n \n-\t// Return YAML bundle with proper content-type\n+\t// Return YAML bundle with proper content-type. The bundle inlines a\n+\t// freshly-minted X25519 private key, so suppress every layer of cache\n+\t// between server and operator (intermediate proxies/CDNs, browser disk\n+\t// cache). Mirrors the Web-UI sibling at internal/web/handlers.go.\n \tw.Header().Set(\"Content-Type\", \"application/yaml; charset=utf-8\")\n+\tw.Header().Set(\"Cache-Control\", \"no-store\")\n+\tw.Header().Set(\"Pragma\", \"no-cache\")\n+\tw.Header().Set(\"Expires\", \"0\")\n+\tw.Header().Set(\"X-Content-Type-Options\", \"nosniff\")\n \tw.WriteHeader(http.StatusOK)\n \tif _, err := w.Write(bundle); err != nil {\n \t\ts.logger.Error(\"write mobile bundle response\", \"error\", err)\ndiff --git a/internal/api/mobile_bundle_test.go b/internal/api/mobile_bundle_test.go\nindex dcb8cd9..da08b01 100644\n--- a/internal/api/mobile_bundle_test.go\n+++ b/internal/api/mobile_bundle_test.go\n@@ -52,6 +52,19 @@ func TestHandleMobileBundle_Success(t *testing.T) {\n \t\tt.Errorf(\"Content-Type = %q, want \u0027application/yaml; charset=utf-8\u0027\", ct)\n \t}\n \n+\t// Bundle inlines a private key \u2014 every cache between server and operator\n+\t// must drop the response. Mirrors the Web-UI sibling\u0027s headers.\n+\tfor header, want := range map[string]string{\n+\t\t\"Cache-Control\":         \"no-store\",\n+\t\t\"Pragma\":                \"no-cache\",\n+\t\t\"Expires\":               \"0\",\n+\t\t\"X-Content-Type-Options\": \"nosniff\",\n+\t} {\n+\t\tif got := w.Header().Get(header); got != want {\n+\t\t\tt.Errorf(\"%s = %q, want %q\", header, got, want)\n+\t\t}\n+\t}\n+\n \t// Verify body is valid YAML with expected keys\n \tvar yamlData map[string]interface{}\n \tif err := yaml.Unmarshal(w.Body.Bytes(), \u0026yamlData); err != nil {\n```",
  "id": "GHSA-6vgg-xhvh-38ff",
  "modified": "2026-06-12T18:30:09Z",
  "published": "2026-06-12T18:30:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/juev/nebula-mesh/security/advisories/GHSA-6vgg-xhvh-38ff"
    },
    {
      "type": "WEB",
      "url": "https://github.com/forgekeep/nebula-mesh/commit/c13d5b2c013b4b323bc0c87a6ecc6afba6384ee5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/juev/nebula-mesh"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store"
}

GHSA-7RFJ-FX9J-89G3

Vulnerability from github – Published: 2026-01-19 18:30 – Updated: 2026-01-19 18:30
VLAI
Details

HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.

Severity
2.8 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-52659"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-19T18:16:03Z",
    "severity": "LOW"
  },
  "details": "HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.",
  "id": "GHSA-7rfj-fx9j-89g3",
  "modified": "2026-01-19T18:30:27Z",
  "published": "2026-01-19T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52659"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b\u0026searchTerm=kb0127995#"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9MHG-763P-R87W

Vulnerability from github – Published: 2025-04-10 15:31 – Updated: 2025-04-10 15:31
VLAI
Details

IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.

Severity
4.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-43035"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-525"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-10T14:15:25Z",
    "severity": "MODERATE"
  },
  "details": "IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.",
  "id": "GHSA-9mhg-763p-r87w",
  "modified": "2025-04-10T15:31:48Z",
  "published": "2025-04-10T15:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43035"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7230561"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

Protect information stored in cache.

Mitigation
Implementation

Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.

Mitigation
Architecture and Design

Do not store unnecessarily sensitive information in the cache.

Mitigation
Architecture and Design

Consider using encryption in the cache.

CAPEC-37: Retrieve Embedded Sensitive Data

An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.

← Back to the CWE list