CVE-2026-103831: CWE-502 Deserialization of untrusted data in TrueLayer TrueLayer Magento 2 Plugin

This vulnerability (CVE-2026-103831) affects the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component. The plugin uses PHP's unserialize() function without limiting the classes that can be deserialized when reading cached data. If an attacker can write manipulated data to the cache backend (such as Redis or Memcached), they can inject specially crafted PHP objects. When these objects are deserialized by the plugin, it may lead to arbitrary code execution via gadget chains present in the application environment. Exploitation requires the attacker to have write access to the cache infrastructure, which might be possible through local file system access or access to the cache service accessible from Magento.

Successful exploitation can lead to arbitrary code execution on the server running the TrueLayer Magento 2 Plugin, potentially compromising the entire Magento environment. However, exploitation requires a prerequisite condition: the attacker must already have the ability to write manipulated data to the cache backend, which limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to the cache backend (e.g., Redis, Memcached) to trusted users and services only. Monitor and secure the cache infrastructure to prevent unauthorized writes. Avoid using unserialize() on untrusted data or implement strict class whitelisting if modifying the plugin code is possible.