Our news and updates

In MongoDB Server versions v8.2 prior to 8.2.9 and v8.3 prior to 8.3.2 a high severity vulnerability CVE-2026-8336 was detected. This vulnerability allows an authenticated user to cause a post-authentication Denial of Service (DoS) by crashing the mongod process. This occurs due to a use-after-free error when the $_internalJsEmit function (which is not intended to be directly accessible) or the mapreduce command’s map function is invoked in a specific way, followed by subsequent use of the server-side JavaScript engine (e.g., through $where, $function, or mapreduce reduce stage). To address this issue, users should upgrade MongoDB Server to versions 8.2.9 or 8.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8336.

In MLflow versions 3.9.0 and earlier a high severity vulnerability CVE-2026-2652 was detected. This vulnerability allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. This occurs due to an architectural mismatch between Flask and FastAPI authentication mechanisms, where the FastAPI permission middleware fails to enforce authentication on non-/gateway/ routes (such as the Job API and OpenTelemetry trace ingestion API) when the server is started with basic authentication enabled and served via uvicorn. To address this issue, users should upgrade MLflow to version 3.10.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2652.

In Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 a medium severity vulnerability CVE-2026-3473 was detected. This vulnerability allows an authenticated user to access and download files belonging to other users or teams. This occurs due to improper file ownership validation and access control in the Boards API, where crafted requests using valid file IDs are processed without verifying the requester’s permissions. To address this issue, users should upgrade Mattermost to version 11.7.0 and higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3473.

In MongoDB Server versions v7.0 prior to 7.0.34, v8.0 prior to 8.0.23, v8.2 prior to 8.2.9, and v8.3 prior to 8.3.2 a medium severity vulnerability CVE-2026-8202 was detected. This vulnerability allows an authenticated user with aggregation permissions to cause a Denial of Service (DoS) by pinning CPU utilization at 100% for an extended period. This occurs when a densely populated chars mask and a large input string are used in the MongoDB aggregation operators $trim, $ltrim, and $rtrim. To address this issue, users should upgrade MongoDB Server to versions 7.0.34, 8.0.23, 8.2.9, or 8.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8202.

In GitLab EE versions 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 a medium severity vulnerability CVE-2026-6063 was detected. This vulnerability allows an authenticated user with developer-role permissions to remove code owner approval rules from merge requests under certain conditions due to improper access control. To address this issue, users should upgrade GitLab EE to versions 18.9.7, 18.10.6, or 18.11.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6063.

In GitBucket version 4.23.1 a critical severity vulnerability CVE-2018-25332 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary commands remotely (RCE). This occurs due to weak secret token generation and insecure file upload functionality. An attacker can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint. To address this issue, users should upgrade GitBucket to version [укажите исправленную версию]. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2018-25332.

In Mattermost Plugins versions <= 11.5, 11.1.5, 10.13.11, and 11.3.4.0 a medium severity vulnerability CVE-2026-6342 was detected. This vulnerability allows plugin users to create subscriptions to groups that were not whitelisted. This occurs because the system fails to appropriately check for valid namespaces, allowing attackers to bypass restrictions by creating groups that share the same prefix as a whitelisted group. There's no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6342.

In Argo Workflows versions prior to 3.7.14 and 4.0.5 a high severity vulnerability CVE-2026-42296 was detected. This vulnerability, which is an incomplete fix for CVE-2026-31892, allows users with “create Workflow” permissions to bypass the template Referencing Strict mode. By exploiting this, attackers can gain host network access, switch service accounts, override pod security contexts, add tolerations to schedule on control-plane nodes, or enable service account token mounting. Environments relying solely on Argo’s Strict mode without additional Kubernetes-level controls (like PodSecurity admission) are fully exposed. To address this issue, users should upgrade Argo Workflows to versions 3.7.14 or 4.0.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42296.

In CKAN versions prior to 2.10.10 and 2.11.5 a medium severity vulnerability CVE-2026-41255 was detected. This vulnerability allows an attacker to bypass Cross-Site Request Forgery (CSRF) protections. This occurs because accessing views via tokens or unauthenticated requests globally marks the endpoint as not requiring CSRF protection for the lifetime of the server process (e.g., a single worker of uWSGI), exposing subsequent authenticated requests to CSRF attacks. To address this issue, users should upgrade CKAN to versions 2.10.10 or 2.11.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-41255.