Mattermost versions 11.7.x up to 11.7.10 have a vulnerability where outbound internal-connection filtering is not applied to the OpenID discovery endpoint request. This flaw allows a System Administrator to determine if internal addresses and ports are reachable from the server by triggering an unauthenticated login request that initiates the discovery fetch. The issue is classified as low severity with a CVSS score of 2.7.
Mattermost versions 11.7.x through 11.10.x (up to specified patch levels) contain a vulnerability in the WebSocket msgpack decoder where allocation limits are not properly enforced. This flaw allows an authenticated remote attacker to cause excessive server memory allocation by sending a crafted binary WebSocket frame with a large declared Bin32 payload length. The issue leads to a denial-of-service condition due to resource exhaustion.
A vulnerability in the Apache Camel OAuth component allows token caching to serve OAuth 2.0 bearer tokens across profiles sharing the same token endpoint and client ID but differing in scope or client secret. This can cause a profile to use a token issued for another profile's scope or client secret, potentially granting broader access than intended. The issue affects Apache Camel versions from 4.19.0 before 4.22.2. Upgrading to 4.23.0 or 4.22.2 resolves the issue. As a temporary mitigation, token caching can be disabled for affected profiles.
A Linux kernel vulnerability in the Open vSwitch component related to IPv6 address rewriting on IPv6 fragments causes an uninitialized transport header to be accessed, triggering debug warnings under certain configurations. The issue arises because the transport header is not set for non-first IPv6 fragments, but the checksum update function reads the transport header unconditionally. The fix involves early return in the checksum update function to avoid reading uninitialized data for fragment packets.
Mattermost versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10, and 11.10.x up to 11.10.1 contain a vulnerability where the application fails to properly bind the volume of text extracted from an uploaded PDF. This flaw allows an authenticated user to cause a denial of service by uploading a crafted PDF whose compressed content stream expands into a very large amount of text, exhausting server memory.
CVE-2026-90885 is an XML External Entity (XXE) vulnerability in the Apache Camel Saxon component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. The vulnerability arises because the default Saxon Configuration used by the XQueryBuilder allows DOCTYPE declarations and external entity resolution when the message body is already a javax.xml.transform.Source. This can lead to disclosure of files readable by the Camel process and can cause the process to issue network requests to attacker-controlled hosts. Fixed versions are 4.18.5, 4.22.2, and 4.23.0.
boneIO Black suffers from a Cross-Site Request Forgery (CSRF) vulnerability affecting all state-changing API endpoints due to the absence of CSRF tokens and lack of Origin or Referer header validation. An attacker on the same internal network can exploit this by luring a user to a malicious webpage, causing unauthorized actions such as rebooting the controller or toggling relay circuits. This vulnerability leads to loss of integrity and availability of the device. The issue is resolved in version 1.6.0.
A vulnerability in the Infinispan Operator for Red Hat Data Grid exposes keystore and truststore passwords in plain text as command-line arguments when cross-site TLS is enabled. These passwords are visible in the Pod specification to any user with 'get pods' permission in the namespace, accessible via node-level process command lines, and often recorded in audit logs. This exposure increases the risk of unauthorized access to sensitive credentials.
The boneIO black_debian_images package stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with permissions that allow any local user to read it. This exposure enables local users to obtain password hashes for all MQTT accounts and attempt offline dictionary attacks. The vulnerability was fixed in version 1.6.0.
The boneIO Black web interface has a clickjacking vulnerability that allows remote attackers to embed the control panel in an iframe on a malicious website. Authenticated users on the internal network can be tricked into clicking interface elements, causing unauthorized control of physical devices such as relays, gates, or blinds. This vulnerability is compounded by CVE-2026-77053, which disables authentication by default, enabling any internal network user to perform attacker-controlled actions. The issue was fixed in version 1.6.0.
boneIO Black had a vulnerability where several API endpoints were excluded from authentication, allowing unauthenticated remote attackers on the local network to access sensitive information such as system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This information could facilitate reconnaissance and targeted attacks. The issue was fixed in version 1.6.0 by requiring authentication for all API routes, disabling interactive API documentation, and withholding the serial number from anonymous users.
Mattermost versions 11.7.x up to 11.7.10 contain a vulnerability where reserved system post types are not properly validated during scheduled post creation and publication. This flaw allows an authenticated channel member to publish messages that appear as trusted system events via the scheduled post endpoint. The vulnerability has a low severity rating and does not impact confidentiality or availability.
The boneIO Black firmware has a critical security vulnerability where authentication is disabled by default. The management web API listens on all network interfaces and exposes all endpoints without requiring credentials, allowing unauthenticated remote attackers full control over the device. This can lead to denial of service, configuration changes, and manipulation of connected physical circuits. The issue is fixed in version 1.6.0, which enforces administrator account creation and restricts API access to authenticated roles. Versions before 1.2.0 are unsupported and require re-flashing with the fixed system image.
boneIO Black versions prior to 1.6.0 do not limit authentication attempts on their web interface or SSH service and lack password complexity enforcement. This allows unauthenticated remote attackers to perform unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access. The issue was fixed in version 1.6.0 by implementing rate limiting on web login attempts, enforcing a minimum password length of 8 characters, and restricting SSH authentication attempts to three per connection with a shortened login grace time.
boneIO Black has a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the create_timedatectl_sudoers_file() function. This function writes sudoers rules to a predictable temporary file, validates them, and then installs them with root privileges. A local attacker can exploit the race window between validation and installation or use the predictable filename for symlink attacks to inject arbitrary sudoers rules, leading to local privilege escalation to root. The issue is fixed in version 1.6.0.
A critical vulnerability (CVE-2026-93328) exists in Google Cloud MCP Toolbox for Databases versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted parameters.
The boneIO black_debian_images container image granted the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. This allowed a local attacker who compromises the boneio user to escalate privileges to root. The issue was fixed in version 1.6.0 by removing the sudoers rule and docker group membership, and by enforcing privileged operations through restricted helpers with verified migrations.
boneIO Black versions prior to 1.6.0 expose an unauthenticated Node-RED instance at the /nodered/ path via a Caddy reverse proxy. This Node-RED Admin API allows deployment of flows capable of executing arbitrary system commands. An unauthenticated attacker on the local network can exploit this to deploy malicious flows, resulting in remote code execution and full control over the home automation system. The vulnerability is fixed in version 1.6.0.
boneIO Black versions prior to 1.6.0 store sensitive passwords, including MQTT broker and web panel passwords, in cleartext. The API endpoint GET /api/config exposes these passwords to any authenticated user. Due to a related issue (CVE-2026-77053) where authentication is disabled by default, unauthenticated attackers on the same local network can also retrieve all passwords. Version 1.6.0 fixes this by hashing web panel passwords with salted scrypt and restricting access to password files, while MQTT broker passwords are stored securely and no longer exposed via the API.
boneIO black_debian_images includes a Mosquitto MQTT broker configured with default credentials that are identical across all devices and publicly documented. This allows remote attackers to gain full read and write access to the broker, enabling control over connected devices such as relays, blinds, and gates, and the injection of fake entities into linked Home Assistant installations. The issue was fixed in version 1.6.0 by generating unique MQTT passwords per device at first boot. Devices upgraded from earlier versions retain the default credentials unless manually changed.