NPM: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

NPM: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

GHSA-5M98-CGCR-XX3Q n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...

GO-2026-6415 SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel...

PYSEC-2026-3873 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeon Project: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/shell.py shared parser → consumed by...

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeonProject: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing"Component: omnigent/policies/builtins/shell.py shared parser → consumed by...

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

SummaryThe PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing.This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including on ...

PYSEC-2026-3889 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

Summary The PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing. This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including o...

PYSEC-2026-3895 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...

SUSE CVE-2026-55873

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated...

CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...

CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...

CVE-2026-86080

n8n , an open source workflow automation platform, is affected by a fail-open signature verification flaw in its GitHub Trigger . When GitHub returns HTTP 422 and the node reuses an existing webhook, the generated webhook secret is discarded , leaving workflow static data with a webhookId but no ...

CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...

EUVD-2026-69419

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion...

CVE-2026-81379

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Siemens SIPLUS and SIMATIC Products

SUMMARY Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where...

CVE-2026-82758

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...