52 matches found
CVE-2026-57489
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...
CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...
CVE-2026-57489
Prior to version 3.16.0 , FileRise (a self-hosted web-based file manager) is vulnerable to a full authentication bypass when the AUTH_BYPASS feature is enabled. The root cause is that the application trusts configured reverse-proxy identity headers without validating that the request originated f...
EUVD-2026-101634
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...
CVE-2026-57489
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...
CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...
CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...
PT-2026-114224
Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.16.0 Description Deployments with AUTH BYPASS enabled trust the configured reverse-proxy identity header without verifying if the request originated from FR TRUSTED PROXIES. If the backend application port is...
CVE-2026-57489: Authentication Bypass by Spoofing
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...
GHSA-C8W2-FGVX-VHV4 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...
CVE-2026-61682
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682
kcp is a Kubernetes-like control plane. Prior to 0.31.4 and 0.32.2 , the kcp front-proxy does not strip inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. An authenticated tenant can inject headers such as X-Remote-Group: system:maste...
EUVD-2026-83043
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
PT-2026-95474
Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.31.4 kcp versions prior to 0.32.2 Description The kcp front-proxy fails to remove inbound identity headers before forwarding requests to shards. An authenticated tenant can inject forged headers, which the shard trusts ...