CVE-2026-101084 obot before v0.21.1 Authorization Bypass via /mcp-connect

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

CVE-2026-101084 obot before v0.21.1 Authorization Bypass via /mcp-connect

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

SmarterMail - Remote Code Execution

SmarterTools SmarterMail build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication. id: CVE-2026-24423 info: name: SmarterMail - Remote...

CVE-2026-101084: Authorization Bypass Through User-Controlled Key

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, which has no special case for HTTP/1 CONNECT and instead runs the generic request conversion, drawing :authority from the Host header rather than the...

CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663

Netty's HTTP/3 codec (io.netty:netty-codec-http3 ) versions 4.2.2.Final through 4.2.17.Final are vulnerable to a request smuggling or bypass issue in HttpConversionUtil.toHttp3Headers. The root cause is the failure to special-case HTTP/1 CONNECT authority-form request-targets during HTTP/1-to-HTT...

CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

EUVD-2026-87757

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java (CVE-2026-16440)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation...

Security Bulletin: IBM App Connect Enterprise is affected by multiple vulnerabilities in Eclipse Jetty.

Summary IBM App Connect Enterprise Toolkit is affected by multiple vulnerabilities in Eclipse Jetty. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Java SDK ( CVE-2026-61308, CVE-2026-70907 & CVE-2026-60589)

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime.

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

BIT-CONSUL-2026-88021 Consul vulnerable to an authorization bypass in the Connect service mesh

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in...

CVE-2026-98152

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...

DEBIAN-CVE-2026-98152

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...

UBUNTU-CVE-2026-98152

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...