These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-50631 is a HIGH severity vulnerability in Apache CXF's AbstractOAuthDataProvider. A race condition allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens when 'recycleRefreshTokens' is set to false. This can be exploited if a refresh token is leaked and replayed concurrently by multiple attackers or threads. Users are recom [truncated]
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class of Apache CXF. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely.
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files.
CVE-2026-50628 is a vulnerability caused by a logic error in OAuthRequestFilter. This error leads to the filter rejecting legitimate requests that originate from the bound IP address, while it blindly allows requests from any other IP address. As a result, enabling this security feature inadvertently creates an inverse security check, potentially exposing systems to unauthorized access.
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks.
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However, note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are re [truncated]
CVE-2026-49875 is a vulnerability in Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes. These classes construct a SAXParserFactory without the necessary JAXP hardening configurations, which enables out-of-band (OOB) external entity resolution. This vulnerability was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-49875) and last modified on [cveModifiedAt](https [truncated]
CVE-2026-47342 is a high-severity privilege escalation vulnerability in Apache OFBiz. The vulnerability allows a low-privileged authenticated user to obtain higher privileges. This issue affects Apache OFBiz versions before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue. The CVSS score for this vulnerability is 8.8, indicating a high severity.
The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitra [truncated]
CVE-2026-49975 debrief: EasyApache 4 update patches HTTP/2 cookie header vulnerability allowing attackers to craft malicious headers that multiply across streams, consuming excessive memory. The fix makes cookie headers count against LimitRequestFields. Note: HTTP/2 is not enabled by default in cPanel configurations. For a full list of changes, read the EasyApache 4 change log. This update requires attent [truncated]
Apache Fesod (Incubating) fesod-sheet versions prior to 2.0.2-incubating contain a Server-Side Request Forgery (SSRF) vulnerability in the UrlImageConverter component. The flaw allows attackers to supply arbitrary image URLs that trigger outbound network requests from the server to internal or restricted resources. This can enable unauthorized access to internal services, cloud metadata endpoints, or othe [truncated]
Apache Fluss (incubating) versions 0.8.0 and 0.9.0 contain a denial-of-service vulnerability in the Netty-based network layer. The LengthFieldBasedFrameDecoder is configured with Integer.MAX_VALUE as the maximum frame length, permitting unauthenticated remote attackers to exhaust JVM heap memory on both TabletServer and CoordinatorServer components by sending crafted frame headers. The vulnerability was d [truncated]
A vulnerability in Apache Airflow's KubernetesExecutor exposes JWT authentication tokens through worker pod command-line arguments, enabling privilege escalation for attackers with Kubernetes read-only access in the Airflow namespace. The flaw affects deployments using KubernetesExecutor and requires complementary fixes on both the core Airflow platform and the CNCF Kubernetes provider.
An unauthenticated information disclosure vulnerability exists in Apache ActiveMQ Broker, Apache ActiveMQ, and Apache ActiveMQ All. Brokers configured with a network connector and syncDurableSubs enabled incorrectly respond to BrokerInfo commands without requiring authentication, exposing durable topic subscription metadata including client identifiers, subscription names, topic destinations, and JMS sele [truncated]
Apache Airflow's core email utilities fail to verify SMTP server certificates during STARTTLS negotiation, enabling network-positioned attackers to intercept credentials and message contents via forged certificates. This CVE addresses the core `apache-airflow` package, complementing the prior SMTP-provider fix in CVE-2026-41016 (2026-04-27). Affected configurations use `[email] smtp_starttls=True` without [truncated]
Apache ActiveMQ contains an Incorrect Default Permissions vulnerability (CWE-276) in its Jolokia authorization configuration. The default settings grant non-administrative web-login accounts access to privileged broker management operations—including addQueue and removeQueue—that are intended for administrative users only. This authorization bypass allows low-privilege authenticated attackers to execute a [truncated]
A path traversal vulnerability in Apache MINA SSHD's sshd-git bundle allows authenticated SSH users to access git repositories outside the configured git server root directory. The flaw stems from missing path validation in git-upload-pack, git-receive-pack, and other git operations. Only applications using the org.apache.sshd:sshd-git artifact are affected; applications not using sshd-git are not vulnera [truncated]
A residual authentication flaw in Apache Airflow's logout handling allows previously-issued JWT tokens to remain valid after a user clicks logout in the UI. The vulnerability specifically affects deployments using FabAuthManager or KeycloakAuthManager, where the logout flow fails to reach the underlying `revoke_token()` call. This leaves JWT tokens accepted by the API server until their natural expiration [truncated]
An authorization inconsistency in Apache Airflow's Event Log API allows authenticated users with audit-log read permission for one DAG to retrieve audit-log entries for any other DAG by directly accessing the detail endpoint with a numeric event log ID. The collection endpoint (`GET /api/v2/eventLogs`) correctly applies per-DAG scoping, but the detail endpoint (`GET /api/v2/eventLogs/{event_log_id}`) only [truncated]
Incomplete authorization in Apache ActiveMQ allows authenticated users with destination removal permissions to remove existing destinations due to missing authorization checks. The vulnerability affects Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ core packages in versions before 5.19.7 and from 6.0.0 before 6.2.6. The issue was published on 2026-06-01 and is currently undergoing analy [truncated]
Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ are affected by an improper input validation and code injection vulnerability. Non-parenthesized discovery wrappers—specifically `masterslave:vm://...,...` and `static:vm://...`—incorrectly pass validation, bypassing the fix for CVE-2026-34197. An authenticated attacker with access to the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console can inv [truncated]
CVE-2026-45426 is an authorization bypass in Apache Airflow's Log server that allows authenticated workers with a valid per-Dag JWT to access worker logs of other Dags. The root cause is a misuse of Python's `str.lstrip()` for path-prefix validation: `lstrip()` removes any combination of the specified characters from the left of a string rather than matching an exact prefix. A JWT issued for Dag `dag_a` w [truncated]
Apache Airflow's scheduler-side `SerializedCustomReference.deserialize_reference` method deserializes arbitrary class paths from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. In deployments where the DAG bundle is importable from the scheduler process—including default single-host configurations—a DAG author can embed a malicious `DeadlineReference` whose serialized [truncated]
Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 contain hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable). When administrators use this tool to bootstrap BasicAuth, the tool silently installs publicly known default credentials for template users (superadmin, admin, search, index) alongside the user-specified account. A remote attacker can leverage these well-known de [truncated]
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on its web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the 'ma [truncated]
A vulnerability in Apache Airflow's rendered-template field handling allows nested sensitive-key masking to be bypassed when rendered fields exceed the configured `[core] max_templated_field_length` threshold. When this limit is exceeded, Airflow stringifies the JSON structure before applying redaction, causing nested keys such as `password`, `token`, `secret`, and `api_key` to lose their contextual maski [truncated]
A fix-bypass vulnerability in Apache Airflow's XCom PATCH endpoint allows authenticated users with XCom write permissions to set reserved key names (e.g., `return_value`) that were blocked in the POST endpoint by the `FORBIDDEN_XCOM_KEYS` validator added in CVE-2026-33858. The PATCH endpoint's missing validation, combined with acceptance of serialized payload shapes that the triggerer's deserializer treat [truncated]
A residual information disclosure vulnerability in Apache Airflow's Variable response masker allows authenticated users with Variable read permission to retrieve plaintext secrets from deeply-nested JSON Variables when nesting depth exceeds the shared secrets masker's recursion limit. The masker returns the original nested item before checking for sensitive key-name suffixes (e.g., password, token, secret [truncated]
Apache ActiveMQ's MessageServlet copies all JMS message properties into HTTP response headers without validation, enabling header injection and security header manipulation. The vulnerability affects ActiveMQ before 5.19.7 and versions 6.0.0 through 6.2.5, as well as Apache ActiveMQ Web in the same ranges. The MessageServlet has been deprecated and disabled by default in the fixed versions.
CVE-2026-42252 documents a documentation-pattern vulnerability in Apache Airflow where the official documentation at `core-concepts/dag-run.html` presented a `BashOperator` example using `dag_run.conf` values without shell-quoting or sanitization warnings. DAG authors who copied this verbatim pattern into production deployments exposed trigger-authorized users to shell metacharacter injection via the `con [truncated]
