CVE-2026-103412 is a path traversal vulnerability in Apache Camel Karavan versions from 3.18.0 up to but not including 4.22.1. An authenticated user can supply a project file name containing '../' sequences, causing files to be written outside the intended project directory. This allows overwriting of application configuration or classpath files, potentially enabling code execution within the Karavan container. The issue is fixed in version 4.22.1.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 have a vulnerability where StaxUtils does not limit the total number of XML elements or characters by default. This can lead to excessive memory and CPU usage during XML parsing, potentially causing a denial of service. The issue is fixed by introducing default limits on element count and document size in the specified versions.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 contain a vulnerability in the Netty-based HTTP client transport where the hostname in the server's TLS certificate is not verified against the host being called. This flaw affects both HTTP/1.1 and HTTP/2 connections and allows a network attacker who can intercept traffic to impersonate the target service by presenting any trusted certificate. This can lead to reading or modification of exchanged messages, including credentials. Upgrading to fixed versions is recommended.
Apache CXF contains a vulnerability in its multipart/MTOM attachment part header parser where configured limits on header size and count are not fully enforced. This allows a remote unauthenticated attacker to send specially crafted multipart requests with very large folded or repeated headers, causing unbounded memory allocation and resulting in a denial of service. Versions prior to 4.2.4, 4.1.9, and 3.6.13 are affected. Upgrading to these fixed versions mitigates the issue.
CVE-2026-100227 is a high-severity vulnerability in Apache CXF's JAX-RS XML Security module involving improper verification of cryptographic signatures. The affected XML Signature interceptors did not ensure that the XML content passed to the application was fully covered by the signature, allowing an attacker to wrap a signed document inside unsigned content that the application would mistakenly treat as signed. This issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
Apache CXF contains a vulnerability in the STSTokenValidator component where the validation result of a SAML assertion signed by a trusted certificate is stored in a shared object accessible by all requests. This allows a remote, unauthenticated attacker to send a forged assertion signed with an untrusted certificate that could be mistakenly accepted as trusted during concurrent request processing. The issue affects services using STSTokenValidator without the alwaysValidateToSts setting enabled. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address this vulnerability.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 contain a vulnerability in the STSTokenValidator and Security Token Service (STS) where validated security tokens are cached using a non-cryptographic 32-bit hash. This allows an attacker to craft a token that collides with a cached hash, bypassing password validation and signature verification, potentially authenticating as another user and obtaining STS-signed tokens for that identity. The issue is fixed in versions 4.2.4, 4.1.9, and 3.6.13.
Apache CXF's FIQL query parser has a vulnerability where it can consume excessive CPU resources when processing long strings without operators. This can lead to denial of service by slowing or stopping other requests. The issue is fixed by limiting FIQL expressions to 4 KiB by default. Users should upgrade to versions 4.2.4, 4.1.9, or 3.6.13 or later to mitigate this risk.
Apache CXF contains an open redirect vulnerability in its OIDC relying-party component that allows redirection to attacker-controlled URLs after authentication. This occurs because state parameters controlled by an attacker are used as redirect targets without proper validation. Both directly and double-encoded URLs can exploit this issue. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address this vulnerability.
CVE-2026-78384 is a high-severity vulnerability in Apache CXF where the CompressionUtils.inflate() method decompresses attacker-controlled DEFLATE data without limiting the output size. This can cause a small crafted payload to expand to gigabytes on the heap, potentially leading to resource exhaustion. The flaw is exploitable via JWE decryption with zip=DEF and SAML redirect/POST binding token inflation, both occurring before trust validation. Fixed versions include 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable maximum inflated-size cap to prevent excessive memory usage.
CVE-2026-73179 is a high-severity race condition vulnerability in Apache CXF's JPA OAuth2 authorization code grant provider. It allows a remote attacker to obtain multiple valid access tokens from a single authorization code by exploiting a time-of-check to time-of-use (TOCTOU) flaw in the non-atomic find-then-delete operation under READ_COMMITTED isolation. This issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
CVE-2026-71575 is a critical vulnerability in Apache CXF affecting the OidcClientCodeRequestFilter component. Due to a milliseconds/seconds unit mismatch and inverted comparison polarity, the max_age authentication freshness check was ineffective. This flaw allows relying parties using setMaxAgeOffset to enforce re-authentication to bypass step-up authentication policies, accepting sessions of any age. The issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions.
The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view.
Successful exploitation may expose sensitive user information and facilitate account enumeration.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler.
The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster.
This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.
These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.
Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler that allows authenticated users to operate task instances in projects they are not authorized to access. The vulnerability affects versions before 3.4.3 and can be exploited via specific API endpoints related to stopping task instances and saving task instance savepoints. The issue is fixed in version 3.4.3.
CVE-2026-66084 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. It allows authenticated users to modify task definitions in projects they are not authorized to access by exploiting a flaw in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint does not verify that the task definition code belongs to the specified project, enabling unauthorized modification of task definitions and their upstream dependencies. This can compromise workflow integrity and disrupt task execution in unauthorized projects. The issue is fixed in version 3.4.3.
CVE-2026-66082 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. Authenticated users with permissions in one project can perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects by exploiting improper verification of resource ownership. This allows altering workflow availability and interfering with task execution in projects they should not access. The issue is fixed in version 3.4.3.
CVE-2026-103371 is a vulnerability in Apache Geode versions 2.0.0 up to but not including 2.0.3. It involves the insertion of sensitive information into log files via the Web Management interface. This issue has a high severity rating with a CVSS score of 7.5. The vulnerability does not affect confidentiality, integrity, or availability beyond the exposure of sensitive data in logs. Users are advised to upgrade to Apache Geode version 2.0.3, which addresses this issue.
— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.