rootpwn

critical · CVSS v3 9.1

CVE-2026-93685

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authenti…

Description

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

Scores

Severity
critical
CVSS v2
4.8
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-93564

HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak allows memory exhaustion. The flaw resides in the handling of nested TLVs in the PROXY protocol. It can lead to denial of service on affected HAProxy instances.

View analysis

critical

CVE-2026-93565

CVE-2026-93565 allows an attacker to send RTSP requests with trailing control bytes that are silently stripped by RtspMethods.valueOf(), causing the server to treat them as valid method tokens. This flaw exists in Netty-based RTSP servers and can lead to unauthorized or malformed requests being accepted as legitimate. The vulnerability is critical with a CVSS v3 score of 9.8.

View analysis

critical

CVE-2026-93567

HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

View analysis

critical

CVE-2026-93569

HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

View analysis