Security Bulletin: IBM Operational Decision Manager for Sept 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2026-87822 DESCRIPTION: t-digest versions 3.1 through 3.3 fail to validate centroid means during...

GO-2026-6508 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc...

CVE-2026-75595

A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security TLS ClientHello messages to bypass the Server Name Indication SNI routing mechanism. This forces a fallback to a less secure...

GHSA-W34Q-CM8F-9C5X OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and Milo

Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and Milo. Vulnerability Details CVEID:CVE-2026-75595 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final,...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Netty

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-62243 DESCRIPTION: Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final...

CVE-2026-85597

A flaw was found in Traefik. This vulnerability allows unauthenticated attackers to bypass client-certificate authentication. By creating conflicting Transport Layer Security TLS options on multi-host routers, attackers can exploit shared TLS resolution across multiple hostnames in a single route...

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Summary A fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route's mTLS requirement. Details In...

SUSE CVE-2026-85597

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

CVE-2026-85597

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

EUVD-2026-71020

Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution...

CVE-2026-85597

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

CVE-2026-85597

Traefik versions before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability in multi-host routers. When multiple hostnames share a single router rule with conflicting TLS options, the strict mutual TLS (mTLS) requirement falls back to default options for all...

CVE-2026-85597 Traefik before v2.11.55 mTLS Bypass via TLS Option Conflict

Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution...

CVE-2026-85597: Incorrect Authorization

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

PT-2026-85497

Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution...

Linux Distros Unpatched Vulnerability : CVE-2026-15576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification...

SUSE CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...