CVE-2026-55094

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

EUVD-2026-90208

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094

Taskcluster, a task execution framework used by Mozilla, is vulnerable to unauthenticated remote code execution (RCE) in versions prior to 100.3.0 . The vulnerability exists in the web-server component when an anonymous role is present that exposes the GraphQL endpoint . Specifically, the applica...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

MAL-2025-5241 Malicious code in taskcluster-db (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 015560a72e308c3ba1770533176ac7fe0bcfbe4892581829992ee47063774f5c Any computer that has this package installed or running should be considered...

Malicious code in taskcluster-db (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 015560a72e308c3ba1770533176ac7fe0bcfbe4892581829992ee47063774f5c Any computer that has this package installed or running should be considered...

Mozilla: sentry Auth Token exposed publicly in docker hub image

The Sentry authentication token was exposed publicly in Docker Hub images belonging to the Taskcluster project. The token was found in the source code of the images and was still active, allowing access to the Sentry API...

taskcluster-client-web (>=39.1.1, <=39.1.2) potentially affected by CVE-2022-29167 via hawk (9.0.0)

hawk NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on hawk and may be impacted: - taskcluster-client-web =39.1.1, =39.1.2 Source cves: CVE-2022-29167 Source advisory: OSV:GHSA-44PW-H2CW-W3VQ...

Mozilla Bug Bounty Program Doubles Payouts, Adds Firefox Monitor

Mozilla is bumping up its bug bounty payouts and has added new websites and services – including the recently deployed Firefox Monitor– to its bug bounty program in hopes of attracting more researchers to sniff out vulnerabilities. The browser-maker is doubling bug bounty payouts for most of its...