CVE-2026-105765 Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...

CVE-2026-105765

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...

EUVD-2026-110050

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...

Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

Summary HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent’s service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...

HashiCorp Consul input validation error vulnerability

Versions prior to HashiCorp Consul 2.1.0, as well as versions prior to HashiCorp Consul Enterprise 1.21.19 and 2.1.0, contain an input validation error vulnerability. This vulnerability stems from authorization bypass in service mesh proxy registration, potentially allowing users with write acces...

PT-2026-125023

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability CVE-2026-105608 is fixe...

PT-2026-125024

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...

HashiCorp Consul authorization issue vulnerability

HashiCorp Consul and Consul Enterprise versions 1.17.0 through 2.0.4 contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in the service mesh leaf certificate API of the agent, potentially allowing attackers lacking valid ACL tokens to obtain cached...

CVE-2026-115997

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injectio...

Pig-Mesh Pig input validation error vulnerability

Versions 4.0 and 4.1.0 of Pig Mesh contain a security vulnerability. This vulnerability stems from improper handling of the “ascs” and “descs” parameters in the orderItem.getColumn function within the file...

CVE-2026-115997 pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injectio...

CVE-2026-115997

A SQL injection vulnerability exists in pig-mesh pig versions up to 4.1.0 . The flaw is located in the orderItem.getColumn function within the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Specifically, manipulating the ascs/d...

CVE-2026-115997 pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injectio...

CVE-2026-115997 pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injectio...

EUVD-2026-109323

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injectio...

PT-2026-122670

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injectio...

EUVD-2026-109139

Zephyr's OpenThread integration defined CONFIGOPENTHREADJOINERPSKD with default "J01NME" in modules/openthread/Kconfig.thread previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread. J01NME is the example Joining Device Credential used throughout the public...

CVE-2026-19741 OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)

Zephyr's OpenThread integration defined CONFIGOPENTHREADJOINERPSKD with default "J01NME" in modules/openthread/Kconfig.thread previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread. J01NME is the example Joining Device Credential used throughout the public...

Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 aka Earth Sirrush obtaining initial access to the target on July 16,...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.6. It stems from ath11k failing to reset numstations during hardware startup; multiple hardware reboots subsequently result in the inability to add new stations or mesh peers...