CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-53431

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication clientsecretjwt and...

GHSA-4JC5-G844-4X33 linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

Summary lib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...

EUVD-2026-51152

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...

EUVD-2026-51145

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication clientsecretjwt and...

CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication clientsecretjwt and...

CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication clientsecretjwt and...

EEF-CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation

Summary Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication client\secret\j...

CVE-2026-53431

Boruta (malach-it) Authentication Bypass via Capture-replay: from 2.3.0 before 2.3.7, JWT client assertions can be replayed after expiry because exp is not validated. Root causes: check_expiration only verifies presence of exp; token_config returns an empty map, so Joken’s exp validator is not en...

EEF-CVE-2026-65635 Boruta dynamic client registration allows creation of over-privileged OAuth clients

Summary Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register\client/3 forwards...

CVE-2026-65635 Boruta dynamic client registration allows creation of over-privileged OAuth clients

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...

CVE-2026-65635 Boruta dynamic client registration allows creation of over-privileged OAuth clients

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...

CVE-2026-54363

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...

EUVD-2026-51099

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...

CVE-2026-54363

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...

CVE-2026-54363

CentreStack

CVE-2026-54363 CentreStack < 17.5 Hardcoded Key Token Forgery RCE

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...

CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...