Our news and updates

In Portainer Community Edition versions 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0 a high severity vulnerability CVE-2026-44848 was detected. This vulnerability allows a standard non-admin user with endpoint access to potentially achieve Remote Code Execution (RCE) on the host system. This occurs because the Docker plugin management endpoints (/plugins/*) lack proper authorization handler registration. As a result, standard users can bypass Resource Control access restrictions and directly call privileged operations, such as installing and enabling plugins, against the underlying Docker daemon. To address this issue, users should upgrade Portainer Community Edition to versions 2.33.8, 2.39.2, or 2.41.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44848.

In Budibase versions prior to 3.38.1 a high severity vulnerability CVE-2026-45715 was detected. This vulnerability allows an authenticated attacker with Builder permissions to perform a Server-Side Request Forgery (SSRF) attack, potentially accessing internal services such as cloud metadata or internal databases. This occurs because the REST datasource integration follows HTTP redirects without re-checking the new destination against the IP blacklist, enabling an attacker to bypass restrictions by redirecting the request through an attacker-controlled server. To address this issue, users should upgrade Budibase to version 3.38.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45715.

In Grafana versions 6.7.0 through 11.6.13, 12.0.0 through 12.2.7, 12.3.0 through 12.3.5, 12.4.0 through 12.4.2, 13.0.0 a medium severity vulnerability CVE-2026-28383 was detected. This vulnerability allows an authenticated attacker to cause a Denial of Service (DoS) by triggering an out-of-memory condition. This occurs because the Grafana plugin resources endpoint reads the entire request body into memory without size limits, leading to unbounded memory allocation. To address this issue, users should upgrade Grafana to version 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, 13.0.1+security-01. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-283833.

In Kibana versions up to and including 8.19.15, prior to 9.3.3, 9.2.8, up to and including 9.4.1 a high severity vulnerability CVE-2026-42398 was detected. This vulnerability allows an authenticated user with connector management privileges to perform a Server-Side Request Forgery (SSRF) attack and bypass operator-configured connection allowlists. This occurs because an attacker can configure a Webhook connector with a specially crafted target, forcing Kibana to issue outbound requests to destinations that were intended to be blocked by egress restriction controls. To address this issue, users should upgrade Kibana to version 9.2.8 or 9.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42398.

In SQLite versions through 3.29.0 a medium severity vulnerability CVE-2019-16168 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing a browser or any other application using the database. This occurs due to a severe division by zero error in the query planner (specifically within the whereLoopAddBtreeIndex function in sqlite3.c), which is triggered by missing validation of the sqlite_stat1 sz field. To address this issue, users should upgrade SQLite to version 3.29.0 and later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2019-16168.

In authentik versions prior to 2025.12.5 and 2026.2.3 a medium severity vulnerability CVE-2026-41577 was detected. This vulnerability allows an attacker to replay expired SAML assertions or use assertions intended for other service providers, potentially leading to unauthorized access. This occurs because the SAML source response processor (ResponseProcessor.parse()) fails to validate the Conditions element on assertions, improperly ignoring the NotBefore, NotOnOrAfter, and AudienceRestriction restrictions. To address this issue, users should upgrade authentik to versions 2025.12.5 or 2026.2.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-41577.

In MariaDB Server versions before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2 a medium severity vulnerability CVE-2026-35549 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing the server. This occurs because when the caching_sha2_password authentication plugin is enabled and in use, sending a specially crafted large packet triggers a crash due to the unsafe use of the alloca function for memory allocation within sha256_crypt_r. To address this issue, users should upgrade MariaDB Server to versions 11.4.10, 11.8.6, or 12.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35549.

In Kubernetes (all versions) a medium severity vulnerability CVE-2020-8554 was detected. This vulnerability allows an attacker to intercept traffic intended for specific IP addresses, resulting in a Man-in-the-Middle (MitM) attack. This occurs because the Kubernetes API server allows users who can create a ClusterIP service to freely set the spec.externalIPs field. Additionally, an attacker with privileged access to patch the status of a LoadBalancer service can set the status.loadBalancer.ingress.ip field to achieve a similar effect. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-8554.

In Budibase versions prior to 3.39.0 a high severity vulnerability CVE-2026-48152 was detected. This vulnerability allows an authenticated attacker with basic permissions to exfiltrate stored REST datasource authentication credentials. This occurs because the single-datasource routes are improperly guarded by generic table permissions rather than specific builder/admin roles. A Basic user can update a REST datasource’s base URL (config.url) while maintaining the original redacted authentication secrets. When a saved query is subsequently executed, the application sends the stored authorization headers to the newly set, attacker-controlled URL, leading to credential disclosure. To address this issue, users should upgrade Budibase to version 3.39.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48152.