Rocky Linux 8 [CIQ] Security Update: python3-urllib3 (crlsa-2026_36732)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202636732 advisory. urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44431 Tenable has extracted the preceding description blo...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2024_3259)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243259 advisory. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 golang: net/http/cookiejar: incorrect forwarding of...

CVE-2026-91766

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

CVE-2026-91766

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the constructed...

CVE-2026-63329 Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

EulerOS Virtualization 2.12.0 : python-pip (EulerOS-SA-2026-3666)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...

GO-2026-6463 rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone...

Security Bulletin: IBM DataPower Gateway affected by authentication bypass due to follow-redirects (CVE-2026-40895)

Summary IBM DataPower Gateway has addressed CVE-2026-40895 in versions 11.0.0.2, 10.6.0.10, 10.5.0.22 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to...

CVE-2026-88013

A flaw was found in rclone. The HTTP backend in rclone can forward custom or authentication headers, such as API keys, Authorization, or Cookie headers, when following redirects to a different host. This can lead to the disclosure of sensitive information to untrusted destinations. Additionally, ...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

PYSEC-2026-3811 Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-3301)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

SUSE-SU-2026:3970-1 Security update for python-h2

This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386...

CVE-2026-45019

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http...

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

Security Bulletin: Vulnerability in Faraday affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Faraday has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

CVE-2026-55553 urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, requestInternal recursively calls...

PT-2026-81492

Name of the Vulnerable Software and Affected Versions Chainlit versions 2.4.0rc0 through 2.11.x Description Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the 'POST /mcp' endpoint without authentication. The ConnectSseMCPRequest and...

EulerOS Virtualization 2.13.0 : python-urllib3 (EulerOS-SA-2026-3234)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...