rootpwn

critical · CVSS v3 9.1

CVE-2026-86341

CVE‑2026‑86341 is a critical access‑control flaw that allows an attacker to bypass deployment approval checks by disabling strict policies a

Overview

CVE‑2026‑86341 is a critical access‑control flaw that allows an attacker to bypass deployment approval checks by disabling strict policies after a deployment object has been altered. The vulnerability can silently enable unapproved code changes to reach production, compromising the integrity of the deployment pipeline.

Description

The vulnerability exists due to a misplaced access-control routine that checks permissions after an object alteration occurs rather than before. Owners or maintainers can exploit this logic order to silently disable strict deployment approval policies, enabling unapproved code changes to roll into live production.

Impact

The flaw undermines the integrity of the deployment process, permitting unauthorized code changes to be promoted to production. While confidentiality and availability are not directly affected, the loss of deployment integrity can lead to broader security breaches and compliance violations.

Remediation

['Apply the vendor‑issued patch that reorders the permission check to occur before any object alteration.', 'Verify that all deployment approval workflows enforce pre‑deployment validation and do not allow policy changes without explicit authorization.', 'Implement least‑privilege access controls for users who can modify deployment policies.', 'Enable audit logging for policy changes and review logs regularly for unauthorized modifications.', 'Consider adding multi‑factor approval or a separate approval service to guard against single‑point policy tampering.']

Risk context

The CVSS v3 score of 9.1 classifies this as a critical vulnerability. Immediate patching is recommended to prevent potential integrity violations in production environments.

Affected products

  • CI/CD platforms
  • Deployment automation tools
  • Configuration management systems
  • Infrastructure as Code
  • Continuous Delivery
  • Release orchestration
  • Deployment approval modules
  • Pipeline management

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.1
CVSS v4
—
EPSS
—

access-control deployment-approval CI/CD integrity critical policy-bypass

← All CVEs

Related CVEs

critical

CVE-2026-92805

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.

View analysis

critical

CVE-2026-92806

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.

View analysis

critical

CVE-2026-61594

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name="dispatch")`, and custom `dispatch()` guards — and the djust admin extension's staff gate (applied only in the HTTP `as_view` wrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view — including admin list/create/change/delete — and dispatch its handlers. This is fixed in djust 1.0.7. `check_view_auth` now honors the Django `AccessMixin` family on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-`dispatch` forms); and the admin base mixin declares `login_required = True` + an active-staff `check_permissions` gate. As a workaround, gate views using djust's `login_required` / `permission_required` / `check_permissions` attributes (honored on all transports) rather than HTTP-only mixins/decorators.

View analysis

critical

CVE-2026-92576

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost services, and RFC 1918 addresses to extract IAM credentials and internal service data.

View analysis