https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 13:09:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-96770 <p>All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go&#39;s RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate&#39;s private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy&#39;s configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.</p> <p>All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go&#39;s RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate&#39;s private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy&#39;s configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.</p> https://db.gcve.eu/vuln/fkie_cve-2026-96770 https://db.gcve.eu/vuln/ghsa-fhc4-rg5x-86fx <p>All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go&#39;s RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate&#39;s private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy&#39;s configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.</p> <p>All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go&#39;s RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate&#39;s private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy&#39;s configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.</p> https://db.gcve.eu/vuln/ghsa-fhc4-rg5x-86fx