https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 12:34:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-92615 <p>A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git&#39;s process-global client.Protocols map via gitclient.InstallProtocol(&#34;https&#34;, ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant&#39;s repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant&#39;s TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant&#39;s git operations.</p> <p>A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git&#39;s process-global client.Protocols map via gitclient.InstallProtocol(&#34;https&#34;, ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant&#39;s repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant&#39;s TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant&#39;s git operations.</p> https://db.gcve.eu/vuln/fkie_cve-2026-92615 https://db.gcve.eu/vuln/ghsa-q6r7-r3xg-x977 <p>A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git&#39;s process-global client.Protocols map via gitclient.InstallProtocol(&#34;https&#34;, ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant&#39;s repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant&#39;s TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant&#39;s git operations.</p> <p>A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git&#39;s process-global client.Protocols map via gitclient.InstallProtocol(&#34;https&#34;, ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant&#39;s repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant&#39;s TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant&#39;s git operations.</p> https://db.gcve.eu/vuln/ghsa-q6r7-r3xg-x977