CVE-2026-81664

OpenFaaS gateway versions 0.27.11 through 0.27.13 contain a missing authentication flaw on the GET /system/telemetry route. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrap block, so when basic_auth is enabled the route still forwards requests to the provider without a cr...

CVE-2026-73245

Kestra, an open-source event-driven orchestration platform, prior to 2.0.0-rc6 exposed Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env to disclose resolved configuration and POST /loggers/{...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...