Threat database

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-49268 is a high-severity LDAP injection vulnerability in Apache Shiro's DefaultLdapRealm class. It allows remote attackers to inject LDAP special characters into the Distinguished Name (DN) construction by concatenating user-supplied usernames without proper escaping. This can lead to manipulation of the LDAP DN used for bind authentication, potentially enabling authentication bypass or user impersonation. The vulnerability affects all Apache Shiro versions through 2.2.0 and 3.0.0-alpha-1 when using DefaultLdapRealm. Upgrading to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later addresses the issue.

CVE-2026-47340 is a vulnerability in Apache DolphinScheduler before version 3.4.2 that allows authenticated users to access alert instances linked to alert groups for which they lack permission. This exposure of sensitive information does not affect system integrity or availability but compromises confidentiality. The issue is fixed in version 3.4.2, and users are advised to upgrade to this version to remediate the vulnerability.

Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

An incorrect authorization vulnerability in Apache DolphinScheduler allows users with limited permissions to access workflow instance information from projects they should not have access to. This issue affects versions prior to 3.4.2. The vulnerability has a medium severity rating with a CVSS score of 6.5. Upgrading to version 3.4.2 resolves the issue.

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

An authorization flaw in Apache DolphinScheduler before version 3.4.2 allows unauthorized users to access arbitrary data source metadata via the DataSource API. This vulnerability is identified as CWE-863 Incorrect Authorization. The issue is fixed in version 3.4.2.

A critical path traversal vulnerability (CWE-22) exists in Apache Airflow SFTP provider versions prior to 5.8.1. This vulnerability allows a malicious or compromised remote SFTP server to write files outside the intended local directory by using crafted directory-entry names. Exploitation does not require any Airflow account, making any deployment that downloads directories from an untrusted SFTP server vulnerable. Upgrading to version 5.8.1 or later mitigates this issue.

CVE-2026-50632 is a high-severity vulnerability in Apache CXF related to improper input validation and deserialization of untrusted JMS configuration data. It stems from an incomplete fix of a previous issue (CVE-2026-44417) and allows untrusted users who can configure JMS to achieve arbitrary code execution, potentially leading to full system compromise. The vulnerability affects multiple Apache CXF versions prior to fixed releases 4.2.2, 4.1.7, and 3.6.12. Mitigation involves restricting JMS configuration access to trusted administrators only. Official patches are available in the specified fixed versions.

CVE-2026-49875 is an information disclosure vulnerability in Apache CXF caused by improper XML parser configuration that allows out-of-band external entity resolution. This flaw affects the EndpointReferenceUtils and W3CMultiSchemaFactory classes, enabling remote attackers to disclose sensitive information without user interaction. The vulnerability is addressed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. Red Hat products bundling Apache CXF are also affected, but currently no effective mitigation or fix meeting Red Hat's criteria is available for those products.

Apache CXF versions prior to 4.1.7, 4.2.2, and 3.6.12 allow an unlimited number of attachment headers during message deserialization. This lack of restriction can lead to uncontrolled resource consumption, potentially causing denial of service (DoS) conditions. The issue is addressed by imposing a default maximum of 500 attachments per message in the fixed versions.

CVE-2026-50634 is a medium severity vulnerability in Apache CXF affecting the JwsJsonContainerRequestFilter component. It allows processing of metadata that was not authenticated by the accepted cryptographic signature, potentially bypassing the application's trust assumptions about signed HTTP headers or content types. This could affect downstream entity parsing or signed-header consistency checks. Fixed versions include Apache CXF 4.2.2, 4.1.7, and 3.6.12.

CVE-2026-50633 is a high-severity JNDI Injection vulnerability in Apache CXF's JCA integration module that allows arbitrary code execution if an attacker can manipulate the JCA deployment descriptor or runtime activation parameters. The vulnerability affects multiple versions of Apache CXF prior to 4.1.7, 4.2.2, and 3.6.12. The attack complexity is high, requiring specific conditions for exploitation. Red Hat products shipping Apache CXF are affected, but no effective mitigation is currently available that meets Red Hat's criteria. Users are recommended to upgrade to fixed versions to remediate the issue.

CVE-2026-50631 is a high-severity race condition vulnerability in Apache CXF's AbstractOAuthDataProvider. It allows concurrent requests using the same refresh token to bypass single-use restrictions and generate multiple valid access tokens when 'recycleRefreshTokens' is set to false. This flaw can enable attackers to replay a leaked refresh token concurrently, potentially compromising access control. Fixed versions include 4.2.2, 4.1.7, and 3.6.12.

CVE-2026-50630 is a CRLF injection vulnerability in Apache CXF's OAuth2 AuthorizationUtils class. The vulnerability occurs because the 'realm' parameter in the WWW-Authenticate response header is concatenated without sanitizing carriage return and line feed characters. This allows an attacker controlling the realm value to inject arbitrary HTTP headers or split the HTTP response. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.

CVE-2026-50629 is a medium severity vulnerability in Apache CXF where the 'clientId' parameter from HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This improper neutralization of CRLF sequences allows attackers to inject arbitrary content, including fake log entries, into server logs. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVE-2026-50623 is an authentication bypass vulnerability in Apache CXF's OAuth2 TokenIntrospectionService. The flaw is due to a missing 'throw' keyword in the security context check, allowing unauthenticated access to the introspection endpoint if authentication is not enabled. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. The vulnerability has a medium severity with a CVSS score of 4.8.

CVE-2026-47342 is a privilege escalation vulnerability in Apache OFBiz that allows a low-privileged authenticated user to gain higher privileges. The issue affects versions of Apache OFBiz before 24.09.07. Users are advised to upgrade to version 24.09.07, which addresses this vulnerability.