2187 matches found
CVE-2026-16745
The CVE-2026-16745 entry concerns odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). The root cause is an incorrect network binding that allows a malicious actor inside the cluster to bypass authentication and impersonate any user by presenting an arbitrary access token. Th...
CVE-2026-16745 Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
CVE-2026-16745 Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
PT-2026-64083
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the allow origin pat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This...
CVE-2026-16745: Origin Validation Error
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
CVE-2026-13321: Origin Validation Error
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1...
[SECURITY] [DLA 4691-1] rtpengine security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4691-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb July 20, 2026 https://wiki.debian.org/LTS -...
Exploit for Origin Validation Error in Ultraviolet Cocos_Ai
DugganUSA — IETF Hackathon Contributions Real-world threat-in...
CVE-2026-16375: Origin Validation Error
Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16381: Origin Validation Error
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16358: Origin Validation Error
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
Debian dla-4691 : rtpengine - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4691 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4691-1 [email protected] https://www.debian.org/lts/security/...
CVE-2026-46701: Origin Validation Error
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret process.env'NETWORKAIMCPSECRET' ?? '' at bin/mcp-server.ts:89, which causes isAuthorized lib/mcp-transport-sse.ts:254 to return true unconditionally for every reques...
Improper Origin Validation
MCP Python SDK is vulnerable to Improper Origin Validation. The vulnerability is due to the WebSocket transport accepting handshake requests without validating the Host or Origin headers, which allows an attacker to establish unauthorized cross-origin WebSocket connections...
Origin Validation Error
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Origin Validation Error via the HTTP Canvas response. An attacker can gain unauthorized access to actions requiring higher authorization by submitting crafted requests through configured...
EUVD-2026-44798
MCP Python SDK: WebSocket server transport does not support Host/Origin validation...
Missing Origin Validation in WebSockets
Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets in the deprecated websocketserver transport function, which builds a Starlette WebSocket and calls acceptsubprotocol='mcp' without inspecting the connection's...
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...
GHSA-VJ7Q-GJH5-988W MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...