Threat database

The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

Apache Tapestry versions 5.5.0 through 5.9.0 contain a vulnerability that allows unauthorized attackers to download classpath assets via specially crafted URLs. This exposure of sensitive information (CWE-200) can lead to disclosure of potentially sensitive internal resources. The issue is resolved in version 5.9.1, which users are recommended to upgrade to.

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue.

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-55814 is a high-severity vulnerability in Apache Ranger versions up to and including 2.8.0. It involves missing authentication in the Download APIs, allowing unauthenticated access to critical functions. The issue is fixed in version 2.9.0, and users are advised to upgrade to this version to mitigate the risk.

Apache Ranger versions up to 2.8.0 contain a TLS hostname verification vulnerability where the client code improperly validates certificates with host mismatches. This issue is addressed in version 2.9.0. The vulnerability has a high severity rating with a CVSS score of 7.5.

Apache Ranger versions up to 2.8.0 log replayable JWT tokens, exposing sensitive authentication information in logs. This vulnerability is identified as CWE-532, involving the insertion of sensitive data into log files. The issue is fixed in version 2.9.0. The CVSS score is 6.5, indicating a medium severity risk.

Apache Ranger versions up to and including 2.8.0 contain a vulnerability in the UnixAuth authentication method, which lacks protection against brute-force attacks. UnixAuth is not recommended for production use. The issue is resolved in version 2.9.0, which users are advised to upgrade to.

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

CVE-2026-71559 is a deserialization of untrusted data vulnerability in the Go implementation of Apache Fory. An attacker can cause a denial of service by supplying crafted data with malformed type metadata, triggering an uncaught panic. This affects Apache Fory versions from 0.16.0 up to but not including 1.5.0. The issue is fixed in version 1.5.0.

CVE-2026-71558 is a critical heap type confusion vulnerability in Apache Fory C++ polymorphic smart-pointer deserialization. Versions from 0.14.0 up to but not including 1.5.0 are affected. A crafted payload can bypass type compatibility checks, causing an incompatible object to be treated as a base type, potentially leading to denial of service or arbitrary code execution. The issue is fixed in Apache Fory 1.5.0. Applications not using this deserialization feature are not affected.

CVE-2026-71560 is a critical vulnerability in Apache Fory C++ affecting versions from 0.14.0 before 1.5.0. It involves an out-of-bounds read during deserialization of structs containing tagged integer fields, which can lead to information disclosure or denial of service. The issue is fixed in Apache Fory 1.5.0. Applications not using Apache Fory C++ or tagged integer fields are not affected.

CVE-2025-49506 is a timing side-channel vulnerability in the Apache Portable Runtime Utility (APR-util) affecting versions up to and including 1.6.3. The apr_password_validate() function did not perform password or hash comparisons in constant time, potentially allowing attackers to infer sensitive information via timing discrepancies on platforms lacking the crypt() function, such as Windows, BeOS, NetWare, or Android. The issue is fixed in version 1.6.4.

CVE-2026-32327 is a critical vulnerability in Apache Portable Runtime Utility (APR-util) versions 1.6.3 and earlier. It involves uncontrolled recursion in the apr_xml_quote_elem() function, which can be triggered by parsing XML from untrusted sources. This flaw allows a stack recursion attack that can cause denial of service. The issue is fixed in version 1.6.4.

CVE-2026-34191 is a critical SQL Injection vulnerability in the Apache Portable Runtime Utility affecting versions 1.6.0 through 1.6.3. It arises from improper neutralization of special elements in SQL commands via the apr_dbd_oracle provider. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to high confidentiality and integrity impacts without affecting availability.

CVE-2026-34501 is a heap-based buffer overflow vulnerability in the Apache Portable Runtime Utility's Redis client. It affects versions from 1.6.0 through 1.6.3. The issue can cause a denial of service by crashing the application. Users are advised to upgrade to version 1.6.4, which addresses the vulnerability.