CVE-2026-128089 vulnerabilities

Vulnerabilities for packages: infrahub, openstack-barbican-2026.1, openstack-glance-2025.1-fips, openstack-glance-2026.2-fips, superset, airflow-core, openstack-glance-2025.2, openstack-horizon-2026.2, openstack-nova-2025.1, openstack-keystone-2025.2-fips, superset-fips, openstack-tempest-2026.1,...

aegis-stack (>=0.8.0, <=0.19.1), aegis-stack-crawl4ai (>=0.1.0, <=0.2.0) +10 more potentially affected by CVE-2026-53951 via copier (>=9.6.0, <=9.14.3)

copier PYPI version =9.6.0, =0.8.0, =0.1.0, =2.7.0, =1.6.0b0, =0.1.58, =4.12.2rc1, =4.12.2rc1, =5.0.0b2, =4.12.2rc1, =4.12.2rc1, =2.9.1, =2.51.0 Source cves: CVE-2026-53951 Source advisory: OSV:PYSEC-2026-3818...

aegis-stack (>=0.8.0, <=0.19.1), aegis-stack-crawl4ai (>=0.1.0, <=0.2.0) +10 more potentially affected by CVE-2026-53951 via copier (>=9.6.0, <=9.14.3)

copier PYPI version =9.6.0, =0.8.0, =0.1.0, =2.7.0, =1.6.0b0, =0.1.58, =4.12.2rc1, =4.12.2rc1, =5.0.0b2, =4.12.2rc1, =4.12.2rc1, =2.9.1, =2.51.0 Source cves: CVE-2026-53951 Source advisory: OSV:GHSA-9GMC-JQMH-3RVM...

aegis-stack (>=0.8.0, <=0.19.1), aegis-stack-crawl4ai (>=0.1.0, <=0.2.0) +10 more potentially affected by CVE-2026-62999 via copier (>=9.6.0, <=9.15.2)

copier PYPI version =9.6.0, =0.8.0, =0.1.0, =2.7.0, =1.6.0b0, =0.1.58, =4.12.2rc1, =4.12.2rc1, =5.0.0b2, =4.12.2rc1, =4.12.2rc1, =2.9.1, =2.51.0 Source cves: CVE-2026-62999 Source advisory: MEND:CVE-2026-62999...

Infrahub: Deleted and expired API tokens can still authenticate

ImpactA bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. PatchesThis issue is fixed in versions 1.3.9 and 1.4.5 WorkaroundsUser...

Improper Validation Of Certificate Expiration

Infrahub is vulnerable to Improper Validation of Certificate Expiration. The vulnerability is due to a flaw in the authentication logic that improperly validates API token expiration, allowing deleted or expired tokens to be treated as valid. This allows an attackers to gain unauthorized access b...

EUVD-2025-27503

Malicious code in bioql PyPI...

CVE-2025-59036

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...

GHSA-V2P7-4PV4-3WWH Infrahub: Deleted and expired API tokens can still authenticate

Impact A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. Patches This issue is fixed in versions 1.3.9 and 1.4.5 Workarounds...

Improper Validation of Certificate Expiration

Overview infrahub-server is an Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run. Affected versions of this package are vulnerable to Improper Validation of...

Infrahub: Deleted and expired API tokens can still authenticate

Impact A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. Patches This issue is fixed in versions 1.3.9 and 1.4.5 Workarounds...

CVE-2025-59036

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...

CVE-2025-59036

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...

CVE-2025-59036 Infrahub allows authentication with deleted and expired API tokens

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...

CVE-2025-59036

Infrahub (OpsMill Infrahub) authentication bug Allows API tokens that were deleted or expired to remain valid, enabling authentication for tokens tied to active accounts. Affected versions: prior to 1.3.9 and prior to 1.4.5. Root cause: bug in authentication logic. Impact: tokens can authenticate...

CVE-2025-59036 Infrahub allows authentication with deleted and expired API tokens

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...

CVE-2025-59036 Infrahub allows authentication with deleted and expired API tokens

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...

CVE-2025-59036: Improper Validation of Certificate Expiration

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...

OpsMill Infrahub security vulnerabilities

OpsMill Infrahub is an infrastructure resource management platform from the French company OpsMill. A security vulnerability exists in OpsMill Infrahub versions prior to 1.3.9 and prior to 1.4.5, which stems from an error in the authentication logic that could cause deleted or expired API tokens ...