high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-124501

Tidelift moto up to 5.2.4 contains a privilege escalation flaw in the AWS Batch Emulation component. The vulnerability allows remote attacke

Overview

Tidelift moto up to 5.2.4 contains a privilege escalation flaw in the AWS Batch Emulation component. The vulnerability allows remote attackers to manipulate the privileged/volumes argument, leading to improper privilege management. It can be exploited without authentication.

Description

A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality, integrity, and availability of systems running Tidelift moto may be compromised. Attackers can gain elevated privileges, modify or delete data, and disrupt services. Defenders should monitor for unauthorized privilege changes and anomalous volume usage.

Remediation

Upgrade to Tidelift moto 5.2.5 or later where the privileged/volumes handling is fixed. If an upgrade is not immediately possible, restrict network access to the component, enforce least privilege on volumes, and monitor for anomalous privilege escalation attempts.

Risk context

Severity is high with CVSS v3 score 7.3. No EPSS data is available. Defenders should treat this as a high-priority vulnerability requiring timely patching.

Affected products

  • Tidelift moto 5.2.4
  • AWS Batch Emulation

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

privilege-escalation batch-emulation tidelift high-severity remote-exploit volume-privileges

← All CVEs

Related CVEs

high

CVE-2026-124509

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

View analysis

high

CVE-2026-124554

A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-124557

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-124558

A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

View analysis