Data Management and Analytics

In MongoDB Server versions v8.2 prior to 8.2.9 and v8.3 prior to 8.3.2 a high severity vulnerability CVE-2026-8336 was detected. This vulnerability allows an authenticated user to cause a post-authentication Denial of Service (DoS) by crashing the mongod process. This occurs due to a use-after-free error when the $_internalJsEmit function (which is not intended to be directly accessible) or the mapreduce command’s map function is invoked in a specific way, followed by subsequent use of the server-side JavaScript engine (e.g., through $where, $function, or mapreduce reduce stage). To address this issue, users should upgrade MongoDB Server to versions 8.2.9 or 8.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8336.

In MLflow versions 3.9.0 and earlier a high severity vulnerability CVE-2026-2652 was detected. This vulnerability allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. This occurs due to an architectural mismatch between Flask and FastAPI authentication mechanisms, where the FastAPI permission middleware fails to enforce authentication on non-/gateway/ routes (such as the Job API and OpenTelemetry trace ingestion API) when the server is started with basic authentication enabled and served via uvicorn. To address this issue, users should upgrade MLflow to version 3.10.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2652.

In MongoDB Server versions v7.0 prior to 7.0.34, v8.0 prior to 8.0.23, v8.2 prior to 8.2.9, and v8.3 prior to 8.3.2 a medium severity vulnerability CVE-2026-8202 was detected. This vulnerability allows an authenticated user with aggregation permissions to cause a Denial of Service (DoS) by pinning CPU utilization at 100% for an extended period. This occurs when a densely populated chars mask and a large input string are used in the MongoDB aggregation operators $trim, $ltrim, and $rtrim. To address this issue, users should upgrade MongoDB Server to versions 7.0.34, 8.0.23, 8.2.9, or 8.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8202.

In CKAN versions prior to 2.10.10 and 2.11.5 a medium severity vulnerability CVE-2026-41255 was detected. This vulnerability allows an attacker to bypass Cross-Site Request Forgery (CSRF) protections. This occurs because accessing views via tokens or unauthenticated requests globally marks the endpoint as not requiring CSRF protection for the lifetime of the server process (e.g., a single worker of uWSGI), exposing subsequent authenticated requests to CSRF attacks. To address this issue, users should upgrade CKAN to versions 2.10.10 or 2.11.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-41255.

In CKAN versions prior to 2.10.10 and 2.11.5 a critical severity vulnerability CVE-2026-42031 was detected. This vulnerability allows unauthenticated attackers to inject SQL in order to gain access to private resources and PostgreSQL system information due to a flaw in the datastore_search_sql function. To address this issue, users should upgrade CKAN to versions 2.10.10 or 2.11.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42031.

In CKAN versions prior to 2.10.10 and 2.11.5 a critical severity vulnerability CVE-2026-42032 was detected. This vulnerability allows unauthenticated attackers to bypass authorization and gain unauthorized access to private resources and PostgreSQL system information due to a flaw in the datastore_search_sql function. To address this issue, users should upgrade CKAN to versions 2.10.10 or 2.11.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42032.

In Fluentd versions 0.12.29 through 0.12.40 a high severity vulnerability CVE-2017-10906 was detected. This vulnerability allows an attacker to change the terminal UI or execute arbitrary commands on the device via an escape sequence injection through unspecified vectors. To address this issue, users should upgrade Fluentd to version 0.12.41 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2017-10906.

In Grafana versions prior to 12.4.1 a low severity vulnerability CVE-2026-21725 was detected. This vulnerability allows an attacker to bypass authorization and delete a recently recreated data source without permission due to a time-of-check to time-of-use (TOCTOU) race condition. The exploit requires highly stringent conditions, including prior admin access to the originally deleted data source, the new data source having the exact same UID, and the attack occurring on the same pod within a narrow 30-second window. To address this issue, users should upgrade Grafana to versions 13.0.0 and above. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21725.

In Elasticsearch versions before 1.4.5 and 1.5.x before 1.5.2 a medium severity vulnerability CVE-2015-3337 was detected. This vulnerability allows remote attackers to read arbitrary files via unspecified vectors when a site plugin is enabled, due to a directory traversal flaw. To address this issue, users should upgrade Elasticsearch to versions 1.4.5 or 1.5.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2015-3337.