Knowledge Base

In Argo CD versions from 0.9.0 prior to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 a critical severity vulnerability CVE-2026-113672 was detected. This vulnerability allows an attacker to read arbitrary files from the repo-server and potentially cause a Denial of Service (DoS). This occurs because the repo-server evaluates .jsonnet files using an importer that fails to confine import, importstr, or importbin statements to the repository root. By utilizing absolute paths, parent-directory traversal, or symlinks, an attacker can access sensitive data such as /proc/self/environ, service-account tokens, and repository credentials, and expose them by placing the imported contents into a ConfigMap. Furthermore, importing a non-terminating device like /dev/zero can exhaust repo-server memory. An attacker can exploit this by committing a malicious .jsonnet file to a Git repository or by uploading it via the API, which only requires basic Application ‘get’ permissions. To address this issue, users should upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113672.

In Gitea versions prior to 28.1.0 a medium severity vulnerability CVE-2026-110324 was detected. This vulnerability allows an authenticated attacker to access private profile information, leading to unauthorized information disclosure. This occurs because the visibility check for user profiles was improperly applied only to GET requests. The POST /{username} endpoint, which handles follow and unfollow actions, only verified that a user was signed in without enforcing the private profile restrictions. As a result, any authenticated user could extract sensitive details—such as a targeted user’s full name, location, website, and description—directly from the server’s response. To address this issue, users should upgrade Gitea to version 28.1.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-110324.

In GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 a high severity vulnerability CVE-2026-112212 was detected. This vulnerability allows an unauthenticated attacker to poison a shared cache’s OAuth/OIDC discovery document, potentially redirecting authentication flows to an externally controlled server. This occurs due to an Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) flaw, which leads to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses. By exploiting this, an attacker can manipulate the discovery document served to other users or services, compromising the integrity of OAuth/OIDC authentications. To address this issue, users should upgrade GitLab to versions 19.3.6, 19.4.3, 19.5.1, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-112212.

In GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 a medium severity vulnerability CVE-2026-112378 was detected. This vulnerability allows an authenticated user to access paid AI features without a valid subscription. This occurs due to a “Use of Less Trusted Source” flaw, resulting in insufficient server-side validation during billing eligibility checks. By exploiting this weakness, a user can bypass intended subscription restrictions and consume premium resources they are not authorized to use. To address this issue, users should upgrade GitLab EE to versions 19.3.6, 19.4.3, 19.5.1, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-112378.

In Gitea versions up to and including 1.26.4 a [low/medium/high/critical] severity vulnerability CVE-2026-73804 was detected. This vulnerability allows an attacker to bypass API token scope restrictions and gain full, unscoped access to an account. This occurs because a token with the write:user scope can be used to register an attacker-controlled SSH public key on the token owner’s account. When the attacker subsequently makes API requests signed with the corresponding private key, the system authenticates them through HTTP Signature without attaching API token scope information. As a result, route-level token scope checks are skipped, effectively converting a limited user-scoped token into an unscoped API authentication method that retains the account’s full role and repository permissions. To address this issue, users should upgrade to a patched versions Gitea 1.27.2 and Gitea Enterprise 27.3.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73804.

In Dolibarr versions up to 23.0.2 a medium severity vulnerability CVE-2026-112361 was detected. This vulnerability allows a remote attacker to bypass Content Security Policy (CSP) restrictions, leading to a complete protection mechanism failure that can facilitate Cross-Site Scripting (XSS) or unauthorized data exfiltration. This occurs due to a flaw within the htdocs/document.php file. By manipulating requests to this endpoint, an attacker can neutralize the intended CSP headers or security boundaries. To address this issue, users should upgrade Dolibarr to version 24.0.0 or later (patch commit 9f9ffa2). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-112361.