JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass

JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled. id:...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

EUVD-2026-124746

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth...

CVE-2026-93335

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth...

CVE-2026-93335: HashiCorp: Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths…

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth...

CVE-2026-93335

Vault Community Edition and Vault Enterprise are vulnerable to an ACL deny bypass due to inconsistent application of deny rules on request paths differing only by a trailing slash . This flaw may allow an authenticated user with broad delete permissions on system configuration paths to disable a ...

Vault vulnerable to ACL deny bypass via trailing slash

Summary Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engin...

PT-2026-146096

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as /%09/attacker.example/x/; when a redirect is generated, the decoded tab between the slash...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as /%09/attacker.example/x/; when a redirect is generated, the decoded tab between the slash...

Open Redirect

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as...

Open Redirect

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as...

BIT-OPENBAO-2026-63131 OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...

PT-2026-105123

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...

JFrog Artifactory CVE-2026-42018 Detect

Detects CVE-2026-42018: POST /access/api/v1/aws/token/ trailing slash returns an internal anonymous-user JWT even when anonymous access is disabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JFrog Artifactory CVE-2026-42018 anonymous JWT via trailing slash.""" import json from kittysplo...

Fedora 45 : cockpit (2026-d375ea9e79)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d375ea9e79 advisory. Automatic update for cockpit-368-1.fc45. Changelog for cockpit Wed Sep 23 2026 Packit - 368-1 - Limit concurrent connections CVE-2026-91149 - Harden...

CVE-2026-63131

A flaw was found in OpenBao, an open source identity-based secrets management system. This vulnerability allows an authenticated attacker to bypass Access Control List ACL deny rules for LIST operations. By sending a specially crafted LIST request with a trailing-slash, an attacker can list paths...

CVE-2026-63131

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...

CVE-2026-63131 OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...

CVE-2026-63131 OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...