CVE-2026-20468

The CVE-2026-20468 entry concerns the apusys component, with a confused-deputy vulnerability that enables local privilege escalation if an attacker already holds System privileges. Exploitation does not require user interaction. A remediation exists: Patch ID AUTO00833804 (Issue MSV-6741). Extern...

EUVD-2026-52058

In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741...

CVE-2026-18378

The CVE-2026-18378 issue affects the koku-metrics-operator. A vulnerability exists in the CostManagementMetricsConfig custom resource, which allows a user to edit the CR to set an arbitrary upload URL. When authentication.type is token (default), the cluster-global Red Hat Cloud pull-secret beare...

Kibana 9.4.x < 9.4.3 Multiple Vulnerabilities (ESA-2026-54 / ESA-2026-58)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-54 and ESA-2026-58 advisories. - Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics...

GO-2026-5471 Kratos has a Confused Deputy issue in github.com/go-kratos/kratos

Kratos has a Confused Deputy issue in github.com/go-kratos/kratos...

EUVD-2026-46385

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

CVE-2026-49092

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

CVE-2026-49092

CVE-2026-49092 affects Kibana with an Unintended Proxy or Intermediary (CWE-441) that can lead to unauthorized information exposure when processing data from sources not authorized for the user. Connected documents specify the vulnerability stems from functionality not properly constrained by ACL...

CVE-2026-49092 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

Kibana 9.4.3 Security Update (ESA-2026-54)

Unintended Proxy or Intermediary 'Confused Deputy' in Kibana Leading to Unauthorized Information Exposure Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under...

PT-2026-62049

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An Unintended Proxy or Intermediary issue, also known as a Confused Deputy, occurs when a lower-privileged user can manipulate the system to process data from unauthorized sources using the...

EUVD-2026-45934

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

CVE-2026-63763

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

PT-2026-61579

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

CVE-2026-15583

Grafana MCP Server is affected by CVE-2026-15583, a confusion-deputy vulnerability that allows an unauthenticated remote attacker to exfiltrate the server’s Grafana service-account token and perform SSRF via a crafted X-Grafana-URL header. The flaw enables targeting internal services, including c...

PYSEC-2026-2476 FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

Summary While testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHu...

CVE-2026-12879 Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the httpapi.RequestHost process. An attacker can gain unauthorized access to sensitive data by sending requests with a crafted X-Forwarded-Host header, which is trusted over the real...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the httpapi.RequestHost process. An attacker can gain unauthorized access to sensitive data by sending requests with a crafted X-Forwarded-Host header, which is trusted over the real...

CVE-2026-46592

Improper Input Validation, Unintended Proxy or Intermediary 'Confused Deputy' vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName and operationNamespace Exchange header, whose constant values...