CVE-2026-57127 praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

CVE-2026-57127

PraisonAI (multi-agent LLM framework on PyPI) prior to 4.6.58 contains a fail-open authentication bypass in praisonai/recipe/serve.py. When an operator sets auth: api-key or auth: jwt in the recipe YAML but fails to provide the corresponding secret (via YAML field or PRAISONAI_API_KEY / PRAISONAI...

CVE-2026-57128

PraisonAI (praisonaiagents

CVE-2026-84179

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

EUVD-2026-77524

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

EUVD-2026-77521

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-84179 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

EUVD-2026-77482

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

Astra Linux – Vulnerability in xrdp

XRDPT is an open-source remote desktop protocol RDP server. In versions prior to 0.9.23, improper handling of session establishment errors allowed bypassing OS-level session restrictions. The authstartsession function could return a non-zero value 1 in the event of, for example, PAM errors. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Assign dhkey to NULL after kfreesensitive. ctrl-dhkey may be used across multiple calls to nvmetsetupdhgroup for the same controller. Therefore, it’s better to set it to NULL after a error-free release, in order to...

Astra Linux – Vulnerability in Firefox and Thunderbird

The username:password portion was not properly removed from URLs in CSP reports, which could potentially expose HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...

Astra Linux – Vulnerability in dovecot

Dovecot OTP authentication is vulnerable to replay attacks under certain conditions. If the auth cache is enabled, and the username is changed in passdb, then the OTP credentials can be cached, making the same OTP response valid. An attacker who can observe the OTP exchange can log in as the user...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: Potential out-of-bounds writes have been prevented in the handleauthsessionkey function. The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes...

Astra Linux – Vulnerability in dovecot

The attacker can send a specially crafted message before authentication, causing Manageable to allocate a large amount of memory. The attacker can also make manageieve-login unavailable by repeatedly crashing the process. It is necessary to protect access to the Manageable protocol, or install a...

Astra Linux – Vulnerability in sshfs-fuse

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 up to 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path. The findbasepath function removes the brackets, leaving a host value that starts with a “-” and is passed directly to ssh as a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211 – Reject authentication/association requests to APs using our own address. If the AP uses our own address as its MLD Media Access Point Identifier or BSSID Basic Service Set Identifier, then something is clearly...

CVE-2026-90898

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

kernel: sctp: auth: verify auth requirement when auth_chunk is NULL

A flaw was found in the Stream Control Transmission Protocol SCTP authentication mechanism within the Linux kernel. The sctpauthchunkverify function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific condition...

CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898

Bifrost (by maximhq) is vulnerable to unauthenticated remote code execution through its MCP stdio client registration endpoint. When a stdio client is registered via POST /api/mcp/client, Bifrost immediately spawns the specified command in the gateway—no MCP handshake required. By default, authen...