Vault

Vault Enterprise

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

CVE Database V5

CVE-2026-89322: CWE-178: Improper Handling of Case Sensitivity in HashiCorp Vault

Threat actors are increasingly leveraging Web3 decentralized blockchain architectures to enhance command-and-control (C2) infrastructure in cloud supply chain attacks. These attacks target developer workstations and CI/CD pipelines by poisoning open-source dependencies to steal ephemeral cloud credentials and establish persistence. Notable campaigns include the ChainDrop npm worm and the PolinRider campaign, which use Web3 smart contracts and multi-chain transaction queries to dynamically update malware infrastructure and evade traditional detection. DPRK-affiliated actors have been observed using these techniques in recent supply chain compromises. Defensive measures include restricting Web3 network connections where unnecessary, deploying endpoint and network protections, and automating policy controls across CI/CD environments.

This analysis details how threat actors have evolved their cloud supply chain attack techniques by integrating Web3 decentralized blockchain technologies into their command-and-control (C2) infrastructure. Instead of static C2 endpoints, attackers use smart contracts and blockchain transactions to dynamically update and control malware such as the ChainDrop npm worm and PolinRider campaign loaders. These malware strains extract ephemeral cloud identity tokens, service account keys, and deployment secrets from developer endpoints and CI/CD pipelines. The use of Web3 C2 mechanisms, including EtherHiding and cross-chain transaction data hiding, allows attackers to bypass traditional network monitoring and takedown efforts. DPRK-affiliated groups like Alluring Pisces have operationalized these methods in high-profile supply chain campaigns targeting open-source ecosystems. The report emphasizes the importance of evaluating Web3 usage within organizations and implementing targeted security controls to mitigate these advanced supply chain threats.

Palo Alto Unit 42

Threat actors are increasingly leveraging Web3 decentralized blockchain architectures to enhance command-and-control (C2) infrastructure in cloud supply chain attacks. These attacks target developer workstations and CI/CD pipelines by poisoning open-source dependencies to steal ephemeral cloud crede

Original Source

Evolution of Web3 in Cloud Supply Chain Attacks

CVE-2026-105820 is a path traversal vulnerability in HashiCorp Vault Enterprise's ACL policy cache. It allows tokens with specially crafted policy names containing path traversal constructs to access capabilities of policies in other namespaces, including the root namespace. This issue affects Vault Enterprise versions prior to 1.21.12 and has been fixed in versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition is not affected as it does not support namespaces.

The vulnerability arises from improper limitation of a pathname to a restricted directory (CWE-22) in Vault Enterprise's ACL policy cache. When policy names include path traversal sequences, tokens assigned these policies may traverse namespaces and gain unauthorized capabilities from other namespaces, including the root namespace. This could lead to privilege escalation within Vault Enterprise environments that use namespaces. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

CVE-2026-105820 is a path traversal vulnerability in HashiCorp Vault Enterprise's ACL policy cache. It allows tokens with specially crafted policy names containing path traversal constructs to access capabilities of policies in other namespaces, including the root namespace. This issue affects Vault

CVE-2026-105820: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in HashiCorp Vault Enterprise

drupal/examples

The Examples for Developers project for Drupal includes an 'Email Example' feature in the email_example submodule that can be exploited to send illegitimate emails to arbitrary addresses. Due to this security issue, the email_example submodule has been removed until a secure version demonstrating best practices is available. Developers who have used this example to build new modules should review their code for potential vulnerabilities.

The email_example submodule within the Drupal Examples for Developers project contains a vulnerability that allows sending unauthorized emails to arbitrary recipients. This submodule is being removed from the project to prevent misuse until a secure replacement is developed. The vulnerability affects versions of the examples project prior to 4.0.7.

GCVE Database

The Examples for Developers project for Drupal includes an 'Email Example' feature in the email_example submodule that can be exploited to send illegitimate emails to arbitrary addresses. Due to this security issue, the email_example submodule has been removed until a secure version demonstrating be

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. (CVE-2026-107312)

drupal/gutenberg

The drupal/gutenberg module has a vulnerability due to insufficient entity access checks in several editor endpoints. Exploitation requires the attacker to have a role with the “use gutenberg” permission, which mitigates the risk. A patch is available to address this issue.

The drupal/gutenberg module, which provides a new UI experience for node editing using the Gutenberg Editor library, contains a vulnerability where entity access is not sufficiently checked in multiple editor endpoints. This flaw could potentially allow unauthorized actions within the editor interface. However, exploitation is limited to users who already possess the “use gutenberg” permission role. Versions prior to 2.15.0 and versions from 3.0.0 up to but not including 3.0.7 are affected. A patch is available to remediate this vulnerability.

This module provides a new UI experience for node editing using the Gutenberg Editor library. (CVE-2026-107263)

This entry corresponds to a CVE identifier that was rejected or withdrawn by the responsible CVE Numbering Authority. No technical details, affected versions, or exploit information are available, indicating that this is not a recognized vulnerability.

Detailed information about Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. (CVE-2026-6258). Get real-time updates, t

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. (CVE-2026-6258) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-6258

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional