rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

CVE-2026-35414

CVE-2026-35414 Bloque de vulnerabilidad CVE-2026-35414 auth2-pubkeyfile.c vulnerable static int matchprincipalsoptionconst char principallist, struct sshkeycert cert char result; uint i; / XXX percentexpand sequences for authorizedprincipals? / for i = 0; i nprincipals; i++ if result =...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

CVE-2024-50633

CVE-2024-50633 🏆 - CVE-2024-50633 : Vulnerabilidad BOLA en Indico Descubrió y reportó una vulnerabilidad BOLA en Indico. 📜 Descripción de CVE-2024-50633 Una vulnerabilidad de Autorización de Objetos a Nivel Roto BOLA en Indico v3.2.9 permite a atacantes acceder a información sensible de usuarios...

CentOS Linux 8.5 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS8.5:CLSA-2026:1777453856)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1777453856 advisory. - OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2026:1777466402)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777466402 advisory. - OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a...

CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS8.4:CLSA-2026:1777307655)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777307655 advisory. - OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a...

CVE-2026-103053: Missing Authentication for Critical Function

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

Rocky Linux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776444688)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776444688 advisory. - OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or...

JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168 , has called it an evolution of the threat actor's tradecraft. Th...

Storm-3168: Agentic-driven cloud attacks using compromised service principals

In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...

Storm-3168: Agentic-driven cloud attacks using compromised service principals

In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...

BIT-SEAWEEDFS-2026-58372 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios

OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters...

K000163318: OpenSSH vulnerability CVE-2026-35414

Security Advisory Description OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. CVE-2026-35414 Impact There is no impact; F5 products are not...

Astra Linux – Vulnerability in OpenSSH

OpenSSH versions prior to 10.3 mishandle the authorizedkeys principals option in unusual scenarios where a principals list is used in conjunction with a Certificate Authority that utilizes comma characters...

Astra Linux – Vulnerability in Firefox and Thunderbird

Permission prompts for opening external schemes were only displayed for ContentPrincipals, allowing extensions to open them without user interaction through ExpandedPrincipals. This could lead to further malicious actions, such as downloading files or interacting with software already installed o...

K000163055: OpenSSH vulnerabilities CVE-2026-35386 and CVE-2026-35414

Security Advisory Description CVE-2026-35386 In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in...

BIT-OPENBAO-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

PT-2026-65036

Vault’s SSH secrets engine did not require the valid principals list to contain a value by default. If the valid principals and default user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used t...