12 matches found
CVE-2026-125329
Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a...
CVE-2026-125329 Kaneo: Gitea integration access token and webhook secret exposed to any workspace member
Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a...
EUVD-2026-122613
Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a...
CVE-2026-125329
The project management application Kaneo is vulnerable to sensitive information disclosure in versions prior to 2.13.0 . The GET /api/external-link/task/:taskId endpoint improperly returns the integration.config object to any workspace member, including those with the viewer role, provided a task...
CVE-2026-102649
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...
CVE-2026-102649
The Burrito Kubernetes operator (Terraform Automation Collaboration Software) is vulnerable to unauthorized actions prior to version 0.13.0 . When a TerraformRepository omits or leaves the webhookSecret empty, the POST /api/webhook endpoint accepts unsigned GitHub and GitLab events. An attacker w...
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...
Theodo Cloud burrito authorization issue vulnerability
Versions prior to Theodo Cloud Burrito 0.13.0 contain an authorization issue vulnerability. This vulnerability arises because POST /api/webhook accepts unauthenticated GitHub and GitLab events when webhookSecret is missing or empty. Attackers can forge events to create or delete custom resources...
CVE-2026-86080
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...
OpenClaw < 2026.2.1 Authentication Bypass (GHSA-mp5h-m6qj-6292)
The version of the OpenClaw AI assistant installed on the remote host is prior to 2026.2.1. It is, therefore, affected by an authentication bypass vulnerability: - If channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without...