Jan 2, 2026·6 min read·59 visits
pREST, the tool that magically turns PostgreSQL databases into REST APIs, had a magical flaw: it trusted user input to build SQL structure. By manipulating parameters like `_join` and `_returning`, attackers could bypass validation and execute arbitrary SQL, leading to total database compromise. Fixed in version 2.0.0-rc3.
A systemic SQL injection vulnerability in pREST allows unauthenticated remote attackers to execute arbitrary SQL commands via manipulated API parameters. The flaw stems from widespread string concatenation in critical query builders like JOIN and RETURNING clauses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N| Product | Affected Versions | Fixed Version |
|---|---|---|
pREST prestd | < 2.0.0-rc3 | 2.0.0-rc3 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-89 |
| Attack Vector | Network |
| CVSS v4.0 | 9.3 (Critical) |
| EPSS Score | 0.0004 (Low Confidence) |
| Impact | Critical (Data Exfiltration, RCE via SQL) |
| Exploit Status | PoC Available / High Probability |
Netflix Lemur, an open-source TLS certificate management framework, is affected by a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability arises from an incomplete patch for a previous security flaw, CVE-2026-55166. While Lemur version 1.9.2 validated the ACME directory URL against an allowlist during authority creation, it failed to perform the same checks when updating existing authorities. An authenticated user possessing an authority role can exploit this omission to replace the directory URL with internal or cloud metadata endpoints. During subsequent certificate issuance, the Lemur backend executes unauthorized requests, potentially leaking sensitive metadata or credentials.
An authorization bypass and information disclosure vulnerability in Netflix Lemur before version 1.9.3 allows authenticated, low-privilege users to retrieve raw destination configurations, exposing plaintext credentials such as SFTP passwords and private key passphrases.
Netflix Lemur before 1.9.3 contains a missing authorization vulnerability (CWE-862, CWE-639) when handling certificate creation, upload, or modification. Authenticated non-read-only users can manipulate the replaces parameter to silence expiration notifications and hijack certificate rotation tasks for arbitrary targets, leading to unauthorized TLS certificate deployment and traffic interception.
CVE-2026-71317 is a critical Broken Object-Level Authorization (BOLA) / Missing Authorization vulnerability in Netflix Lemur versions prior to 1.9.3. When the self-service authority creation option is enabled (ADMIN_ONLY_AUTHORITY_CREATION = False), Lemur allows authenticated non-read-only users to request the creation of a subordinate Certificate Authority (sub-CA) chained to any internal parent authority, even if the requesting user lacks administrative or usage permissions over that parent CA. This allows attackers to generate subordinate CAs signed by trusted root certificates, exposing private keys and compromising the organizational PKI trust chain.
Netflix Lemur, a TLS/SSL certificate management framework, contains a missing authorization check in its certificate export endpoint. Prior to version 1.9.3, the validation logic verifying whether a user had permission to export a certificate was incorrectly placed inside a block that executed only if the selected plugin required a private key. When an authenticated user attempted to export a certificate using a plugin that did not require the private key, the authorization check was bypassed, allowing unauthorized access to the public portions of the certificate and producing misleading audit logs.
A critical security flaw in LibreNMS allows authenticated administrators to execute arbitrary commands by modifying the configured binary path for snmpget and accessing the About page. This occurs due to insufficient verification of the executable file's identity and integrity prior to executing it with shell_exec.