merge-authz-test

merge-authz-test 인가 테스트 CVE-2026-1999 관련...

CVE-2026-34040-PoC

CVE-2026-34040 — Docker/Moby AuthZ Plugin Bypass Lab PoC KO: DockerMoby의 인가AuthZ 플러그인을 1MB를 초과하는 요청 본문 으로 우회하는 취약점의 실습용 재현 프로젝트입니다. EN: A lab reproduction of a vulnerability that bypasses Docker Moby authorization AuthZ plugins using an oversized 1MB request body. Vulnerability facts / 취약점 사실 Ite...

CVE-2023-34035-Poc

CVE-2023-34035: 잘못된 권한 부여...

CVE-2024-41110-SCAN

CVE-2024-41110 Docker 보안 검사기 이 도구는 Docker 설치 환경에서 CVE-2024-41110과 관련된 취약점을 호스트에서 점검하도록 설계되었습니다. 특히 취약한 Docker 버전과 보안 문제로 이어질 수 있는 AuthZ 플러그인 사용 여부를 찾습니다. 사용법 다음 명령으로 스크립트를 실행하세요: python3 scan-CVE-2024-41110.py 참고 Vladimir Poglazov 프로젝트의 요약 버전 - GitHub...

cve-2024-41110-checker

CVE-2024-41110 Docker 보안 검사기 이 도구는 Docker 설치 환경에서 CVE-2024-41110과 관련된 취약점을 여러 호스트에서 점검하도록 설계되었습니다. 특히 취약한 Docker 버전과 보안 문제를 일으킬 수 있는 AuthZ 플러그인 사용 여부를 확인합니다. 기능 여러 호스트를 병렬로 검사하여 효율적인 스캔 취약한 Docker 버전 탐지 AuthZ 플러그인 사용 여부 식별 포괄적인 요약 보고서 생성 영향을 받는 호스트에 대한 해결 방안 제공 비밀번호 기반 및 키 기반 SSH 인증 모두 지원 요구 사항...

CVE-2026-82806

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

CVE-2026-82806

Apache APISIX versions 2.3.0 through 3.6.x are vulnerable to a cross-request permission pollution issue when using a supported authz-keycloak configuration. The root cause involves a static permission list mutation where an authorization scope from one request persists into subsequent requests on...

EUVD-2026-90764

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

CVE-2026-82806 Apache APISIX: cross-request permission pollution via static permission list mutation

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

Rocky Linux 8 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc Multiple Vulnerabilities (crlsa-2026_48790)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202648790 advisory. google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33186...

AlmaLinux 9.2 [TuxCare] Security Update: mod_dav_svn / python3-subversion / subversion / subversion-devel / etc (ALMALINUX9.2:CLSA-2026:1778894989)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778894989 advisory. - Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according ...

Rocky Linux 9 [CIQ] Security Update: image-builder / image-builder-debuginfo / image-builder-debugsource Multiple Vulnerabilities (crlsa-2026_23228)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202623228 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...

CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC 권한 부여 정책 우회 :path 슬래시 누락으로 인한 인증 우회 설명 google.golang.org/grpc의 authz 패키지는 SDK 수준 RBAC 권한 부여를 구현하며, :path 유사 헤더에 대해 거부 및 허용 규칙을 매칭합니다. HTTP/2 서버 전송 계층은 클라이언트로부터 원시 :path 값을 /로 시작하는지 검증 없이 저장합니다. 라우팅 계층handleStream은 디스패치 전에 경로를 정규화하지만, RBAC 엔진은 grpc.Methodctx를 통해 컨텍스트에서...

PT-2026-102725

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext authz filter assumes that a request contains a :path pseudoheader when applying query parameters to set or query parameters to remove from an...

GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...

CVE-2026-93854

In OpenStack Blazar before 17.0.1 , the V2 lease API fails to enforce object-level authorization on update and delete operations due to a parameter name mismatch : the authorize() wrapper looks up the lease under the keyword "lease_id" while the controller methods name the parameter "id" (deliver...

GHSA-5GPM-RGJ3-9Q76 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...