A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
CVE-2026-121821 is a medium severity vulnerability in LY Corporation's Armeria framework versions 0.84.0 through 1.42.0. It involves permissive Cross-Origin Resource Sharing (CORS) policies that fail to enforce configured path restrictions. This allows attacker-controlled websites visited by authenticated users to read sensitive responses from paths that should be excluded when credentials are enabled.
CVE-2026-62863 is a critical vulnerability in gojue moling prior to version 0.5.0. When running in SSE mode with the `-l` option, the `/sse` and `/message` HTTP endpoints do not authenticate requests and allow cross-origin resource sharing from any domain. This permits a malicious web page to obtain a session ID via a cross-origin EventSource connection and then use that session ID to send unauthorized commands to the server. These commands can potentially read or write local files, execute commands, or perform other sensitive actions. The vulnerability is fixed in version 0.5.0.
A vulnerability in the Fiber web framework versions 2.52.1 and 2.52.2 affects the CORS middleware's domain validation. The issue arises from improper origin validation where the wildcard matcher strips the scheme and only checks host suffixes without requiring a dot boundary. This can allow an attacker-controlled origin with a host ending in the configured base domain to bypass restrictions when AllowCredentials is enabled, potentially exposing authenticated cross-origin responses. The vulnerability is fixed in version 2.52.3.
vLLM versions prior to 0.32.0 have a permissive cross-origin resource sharing (CORS) policy that allows any origin by default. This configuration enables malicious web pages to interact with an unauthenticated vLLM server running on localhost, internal networks, or VPNs, potentially consuming GPU resources and reading responses. The issue is resolved in version 0.32.0 by restricting allowed origins.
CVE-2026-107858 is a vulnerability in Google Agent Development Kit (ADK) for Java versions before 1.13.0. It involves missing origin validation in WebSockets and a permissive cross-domain policy, allowing remote attackers to control a locally running agent and access its data via a malicious web page visited by a developer. The vulnerability is fixed in version 1.13.0, which enforces same-origin policies and rejects DNS-rebinding requests over loopback.
IBM Concert versions 1.0 through 3.0.0 have a permissive cross-origin resource sharing (CORS) policy that does not restrict domain names to trusted domains. This vulnerability could allow an attacker to perform privileged actions by exploiting the overly permissive CORS configuration. The vulnerability is identified as CWE-942 and has a low CVSS score of 3.7.
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.
CVE-2026-84176 is a medium severity vulnerability in Apache Camel's Platform HTTP Vertx component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue arises because the Access-Control-Allow-Credentials header is set to true on all responses with an Origin header, even when the origin is not allowed, enabling credentialed cross-origin requests from any origin. This permissive cross-domain policy can allow a malicious web page to make credentialed requests and read responses from the Camel endpoint. The vulnerability is fixed in Apache Camel versions 4.18.5 and 4.22.1. Users unable to upgrade immediately can mitigate by explicitly setting allowed origins in the configuration.
CVE-2026-108372 is an origin validation error in the huangruiteng loopx project affecting versions from 0.0.1 up to but not including 0.4.5. The vulnerability allows a remote attacker to induce an operator visiting attacker-controlled web content to perform cross-origin requests to certain endpoints on the local loopx control plane. This can expose control-plane state, goal and run information, local absolute paths, private Markdown files under registered goal roots, and dry-run configuration projections. The affected endpoints do not allow cross-origin writes or arbitrary file access. The issue is fixed in version 0.4.5.
CVE-2026-55842 is an origin validation error in the Scoold Q&A platform prior to version 1.69.1. The vulnerability arises from the apiCorsConfiguration() method allowing any origin with credentials, enabling malicious websites to perform authenticated API requests on behalf of logged-in users. This can lead to unauthorized reading of user data and triggering of state-changing operations. The issue is fixed in version 1.69.1.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = ""), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = "*", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's browser and read the responses.
This exposed /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name} and /user/namespace/{name}/members, and — because /user/csrf was readable the same way — allowed the CSRF protection on write endpoints to be defeated. Chaining the two, an attacker page could call /user/token/create and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces.
The headers were emitted by the CDN/edge layer, not by the application: the Open VSX software sets allowCredentials(true) in exactly one place, against a single exact origin derived from ovsx.webui.url, and defines no CORS mapping on /user/ beyond it. No configuration of the software produces origin reflection with credentials.
HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.
CVE-2026-89058 is a vulnerability in RESTEasy's CorsFilter that occurs when it is configured to allow all origins ('*'). The flaw causes the server to reflect the request's Origin header back in the Access-Control-Allow-Origin response and sets Access-Control-Allow-Credentials to true. This misconfiguration allows malicious websites to perform credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in loss of confidentiality.
Description
Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP
components served to an authenticated user.
The Logviewer reflected the request's `Origin` header back in `Access-Control-Allow-Origin` while also
sending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive
`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to
honour `*` together with credentials; reflecting the concrete origin removes that protection.
The shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name
where an initialisation parameter name was expected. The container ignored the setting and applied its own
defaults, which allow credentials.
Finally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET
request. A script element on any origin can load such a response, which bypasses the same-origin policy
entirely rather than negotiating it, and there was no way to turn the behaviour off.
In each case the effect is that a page visited by an authenticated operator can read cluster, topology and
log data on their behalf.
Mitigation
Upgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the
CORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to
false.
Note that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such
tooling should be moved to ordinary JSON requests.
Users who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse
proxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and
rejects requests carrying a `callback` parameter.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
CVE-2026-62895 is a high-severity vulnerability in Microsoft Azure Arc SQL Server Extension involving a permissive cross-domain security policy that includes untrusted domains. This flaw allows unauthorized attackers to elevate privileges over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 1.1.3518.465. Microsoft has issued an official fix in version 1.1.3518.465. No known exploits are currently reported in the wild.
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.