A vulnerability in the A2A server component of Amazon Strands Agents SDK for Python before 1.43.0 and TypeScript before 1.5.0 allows an authenticated remote user to access other tenants' conversation history and modify model behavior by exploiting improper isolation of conversation state between callers.
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.
Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails.
A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated.
Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
CVE-2026-107929 is a vulnerability in curl where the CURLOPT_INTERFACE option (or the equivalent command line --interface option) uses certain prefixes (if!, host!, ifhost!) that are not included in the connection reuse key. This causes curl to reuse an existing connection with a previously set source address, even when a different source is requested in a later transfer.
CVE-2026-86411 is a vulnerability in curl where an FTP transfer without SSL can reuse a pooled FTP control connection that was previously upgraded with STARTTLS and authenticated with a client certificate. The second connection does not perform a new TLS handshake or FTP login, causing the server to authorize it under the first connection's certificate identity, potentially exposing data to the wrong session.
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or successive requests could therefore observe each other's material, and a Message Disposition Notification could be signed with the key of a partner other than the one the receipt was for. The result is cross-partner key confusion: a receipt attributable to the wrong partner, and one partner's signing material used while handling another partner's exchange. AS2 deployments are typically multi-partner by design, so the condition is reached by ordinary concurrent traffic rather than by anything the attacker must arrange.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Per-request signing keys are now confined to the request being processed in ResponseMDN. For deployments that cannot upgrade immediately, run a separate Camel context per trading partner so that no signing material is shared between them.
CVE-2026-85245 is a vulnerability in Apache Camel's Thrift component where unmarshalling incoming data uses a shared instance, causing data from one message to be exposed to others. This affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw allows data from one tenant or user to be visible to another when served through the same route. The issue is fixed in Apache Camel 4.23.0, 4.18.5, and 4.22.1. Users unable to upgrade immediately should copy the unmarshalled body to a new instance to avoid data leakage.
CVE-2026-82416 is a race condition vulnerability in FrankenPHP when running in worker mode with PHP's session extension loaded as a shared module rather than statically linked. This causes session IDs to leak between concurrent requests, leading to cross-user session exposure and session hijacking. The issue arises because session state reset code is compiled out when the session extension is shared, allowing stale session IDs to persist across requests. Builds with the session extension statically linked are not affected. The vulnerability results in users being intermittently logged out or served sessions belonging to other users.
Exposure of data element to wrong session vulnerability in Apache APISIX.
This issue affects Apache APISIX: from 2.3.0 before 3.7.0.
Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions.
Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.
CVE-2026-86492 is a high-severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It involves a shared token cache that allowed cross-tenant theft of GitHub App installation tokens. This flaw could lead to unauthorized access to sensitive tokens across different tenants. The vulnerability has a CVSS score of 8.5, indicating a significant impact on confidentiality with limited integrity impact and no availability impact. No known exploits are reported in the wild. The affected versions are all releases prior to 2026.2.18634.
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic.
AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run.
This issue affects ash_graphql: from 1.4.0 before 1.11.0.
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
A race condition vulnerability exists in the view_component Ruby on Rails framework versions 4.0.0 up to but not including 4.12.0. The issue arises because ViewComponent::Base instances retain render-scoped objects across calls to render_in, causing stale context to be reused across requests or threads. This can lead to unauthorized UI rendering, leaking of request context, and mixing of state between users. The vulnerability is fixed in version 4.12.0.
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow persist into subsequent Merge SQL executions belonging to other users or projects. This allowed a low-privileged attacker to intercept workflow data processed by other users on the same instance. This issue only affects multi-user n8n instances where more than one user has permission to create and execute workflows containing the Merge node in SQL Query mode. This vulnerability is fixed in 2.25.7 and 2.26.2.
A race condition in the shared Extreme Platform
ONE IAM Gateway API-key authentication path could, under specific
high-concurrency traffic conditions, intermittently allow requests
authenticated with an Extreme Platform ONE /IAM-issued API key to receive
response data for another tenant. The issue was observed through ExtremeCloud
IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE
/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT
authentication were not affected.
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple authenticated WebSocket connections. The handler stores per-connection protocol objects in mutable instance fields. Each new WebSocket connection overwrites those fields. Later, message handlers send responses through the shared fields instead of through protocol objects bound to the originating connection. As a result, the most recently connected authenticated client can receive protocol responses that belong to another authenticated client.
Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.