CVE-2026-104939 NGINX Ingress Controller vulnerability

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...

K000162617: NGINX Ingress Controller vulnerability CVE-2026-104939

Security Advisory Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper...

CVE-2026-54008: Server-Side Request Forgery (SSRF)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/openwebui/utils/oauth.py::processpictureurl calls validateurlpictureurl on the initial URL only, then invokes aiohttp.ClientSession.getpictureurl, ... without...

User may be redirected to On-premises AAA Logout Page after Logging off Citrix Cloud

When you deploy an on-premises Citrix GatewayNetScaler Gateway as the OAuth IDP for Citrix Cloud. User may be redirected toon-premises IDP logout page/vpn/tmlogout.html instead of Citrix Cloud login page after logging out Citrix Cloud. For example, you have the following URLs: Citrix Cloud URL:...

Privilege Escalation

gafana is vulnerable to privilege escalation. An attacker can take over another user's account in the grafana instance by supplying a login name through the specified OAuth IdP when the attacker's external user id is linked to a grafana account, and the attacker knows the grafana user name of the...

CVE-2022-31107: Incorrect Authorization

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of...

PT-2022-7299

Name of the Vulnerable Software and Affected Versions Grafana versions 5.3 through 9.0.3 Grafana versions 8.3 through 8.3.10 Grafana versions 8.4 through 8.4.10 Grafana versions 8.5 through 8.5.9 Description The issue is related to an authorization problem in the Grafana platform, allowing a...