CVE-2026-108575

A flaw was found in LiteLLM. A remote attacker can exploit improper authorization within the secret resolution mechanism by manipulating the apikey parameter. This vulnerability allows an attacker to bypass authorization controls and potentially access protected secrets or resources...

CVE-2026-108575

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function getsecret of the file secretmanagers/main.py of the component Secret Resolution. The manipulation of the argument apikey leads to improper authorization. The attack can be initiated remotely. The exploit has...

CVE-2026-108575 BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function getsecret of the file secretmanagers/main.py of the component Secret Resolution. The manipulation of the argument apikey leads to improper authorization. The attack can be initiated remotely. The exploit has...

CVE-2026-108575

A vulnerability exists in BerriAI LiteLLM (up to version 1.94.0 ) within the Secret Resolution component. The flaw resides in the get_secret function located in the file secret_managers/main.py. Specifically, an attacker can manipulate the api_key argument to cause improper authorization , potent...

EUVD-2026-96885

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function getsecret of the file secretmanagers/main.py of the component Secret Resolution. The manipulation of the argument apikey leads to improper authorization. The attack can be initiated remotely. The exploit has...

Not Failing Securely ('Failing Open')

Overview apache-airflow-providers-hashicorp is a Provider package apache-airflow-providers-hashicorp for Apache Airflow Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' via VaultBackend in vault.py, where connectionspath, variablespath, and configpath each...

EUVD-2026-72540

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

PT-2026-86928

Improper Authentication vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve secret/3 in AshAuthentication.Oauth2Server reached through resolve...

GO-2026-5128 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails in github.com/traefik/traefik

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails in github.com/traefik/traefik...

CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported...

CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported...

CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported...

CVE-2026-54762

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported...

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the...