Jan 1, 2026·6 min read·131 visits
A high-privilege RCE vulnerability (CVSS 9.1) allows operators to turn the audit logging system into an arbitrary file write primitive. By pointing a 'file' audit device at a sensitive path (like `/etc/cron.d`) and injecting a malicious 'prefix', attackers can execute code as the Vault/OpenBao service user. The fix involves disabling API-based audit configuration entirely.
OpenBao and HashiCorp Vault, the literal Fort Knoxes of the DevOps world, suffered a catastrophic logic flaw in their audit subsystems. By abusing the ability to configure audit devices via API, privileged attackers could trick the system into writing malicious code directly to the host filesystem.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H| Product | Affected Versions | Fixed Version |
|---|---|---|
OpenBao OpenBao | < 2.3.2 | 2.3.2 |
Vault Community Edition HashiCorp | < 1.20.1 | 1.20.1 |
Vault Enterprise HashiCorp | < 1.19.7 | 1.19.7 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-94 |
| Attack Vector | Network (API) |
| CVSS Score | 9.1 (Critical) |
| Privileges Required | High (Audit Write) |
| Impact | Remote Code Execution (RCE) |
| Exploit Status | Conceptual / Weaponizable |
Improper Control of Generation of Code ('Code Injection')
A stored and reflected Cross-Site Scripting (XSS) vulnerability was identified in the SiYuan kernel before version v3.7.3. The flaw occurs due to a parser differential between the backend Go-based HTML sanitizer and the browser-side XML rendering engine. Attackers can bypass the SVG sanitizer to execute arbitrary JavaScript within the context of the application's origin, leading to complete workspace compromise, data exfiltration, and full local kernel API manipulation.
An incomplete mitigation in the export-handling logic of SiYuan Notebook allowed authenticated users to bypass directory traversal protections. By crafting a request with percent-encoded path navigation sequences targeting the /export/temp/ route prefix, attackers can trigger an unvalidated short-circuit block that serving arbitrary files from the host server. This bypass renders previous path-traversal mitigations ineffective for the affected endpoint.
CVE-2026-62669 is a critical Improper Authentication vulnerability (CWE-287) in the Grav Login Plugin for Grav CMS. Prior to version 3.8.11, the plugin's key rotation task failed to verify if a user session was fully authorized before regenerating and returning two-factor authentication (2FA) secrets. Consequently, an attacker possessing a victim's primary credentials could invoke this endpoint to replace the 2FA secret, retrieve the replacement, and bypass the MFA constraint entirely.
An interpretation conflict (CWE-436) exists in the Ruby 'mail' library's RFC 2047 decoding implementation. Vulnerable versions utilize regular expressions with overly greedy qualifiers and a singular matching strategy. When parsing malformed headers, these design flaws trigger unexpected exception-handling behaviors, outputting raw, unparsed strings. Consequently, intermediate security gateways and downstream Ruby processors interpret email addresses differently, enabling authentication bypasses, phishing, and header spoofing.
Hurl version 8.0.1 and earlier contains a sensitive information exposure vulnerability during cross-origin HTTP redirections. Cookies defined via a dedicated [Cookies] parser block are carried into the redirected request, whereas standard raw Cookie headers are correctly stripped. This allows attackers to capture session credentials by redirecting Hurl clients to untrusted external hosts.
CVE-2026-63490 is a critical path traversal vulnerability in the Spring MVC integration of Handlebars.java. It allows unauthenticated remote attackers to bypass suffix validation and retrieve arbitrary system files via crafted dynamic view names.