Skip to content

Agent, proxy, Kubernetes, CMS, scanner, and render boundary checks

Source: hourly offensive-security scan, 2026-06-18. Primary entries: GitHub advisories GHSA-r2xf-7jw5-pjg6 / CVE-2026-55887, GHSA-f397-5vjw-v2c2 / CVE-2026-53866, GHSA-fq9j-vw4w-fr6v / CVE-2026-53842, GHSA-ccwh-wwpp-6wg5 / CVE-2026-53864, GHSA-q99w-vh6v-q3v7 / CVE-2026-53843, GHSA-985f-72mj-8gf7 / CVE-2026-53863, GHSA-gcq2-9pq2-cxqm / CVE-2026-55603, GHSA-64mm-vxmg-q3vj / CVE-2026-55602, GHSA-2c85-rfcc-g74j, GHSA-x9g3-xrwr-cwfg / CVE-2026-55388, GHSA-2mrg-35hw-x3x9 / CVE-2026-55229, GHSA-mw9r-p8xp-wx96 / CVE-2026-55225, GHSA-r427-j2h7-wv3m / CVE-2026-55226, GHSA-6x8v-2fq5-2229 / CVE-2026-55670, and GHSA-29jh-8cfq-rr8x / CVE-2026-55671.

This batch is durable because the advisories map to reusable offensive validation boundaries: agent catalog metadata crossing into container launch flags, agent shell/environment/session policy checks that can be bypassed by lower-trust workspace input, unauthenticated AI service APIs invoking tools, approval and webhook gates that fail open, file tools crossing workspace/artifact roots, SSE/MCP transports exposed without origin or authentication controls, reverse-proxy helpers that transform request bodies or route by attacker-controlled host material, mock servers that recursively evaluate request-derived template expressions, prototype-pollution gadgets that turn inherited worker options into code loading, document converters that fetch embedded resources, Kubernetes operators that mint cross-namespace secret permissions from custom resources, and identity providers where recycled identifiers, client binding, token lifetime checks, or user-managed callback URLs cross tenant, OAuth, or network trust boundaries.

What changed

Advisory Component Boundary Operator value
GHSA-r2xf-7jw5-pjg6 / CVE-2026-55887 Docker MCP Gateway attacker-controlled io.docker.server.metadata OCI label YAML mass-assigned runtime fields that became docker run flags Test agent/MCP catalogs where descriptive image metadata can become mounts, users, commands, hosts, secrets, or network policy.
GHSA-f397-5vjw-v2c2 / CVE-2026-53866 OpenClaw shell inline commands one parser path could route inline shell content without the intended allowlist decision Validate every command syntax family against the same approval boundary, especially compact inline forms.
GHSA-fq9j-vw4w-fr6v / CVE-2026-53842 OpenClaw Gmail setup repository-local .env could influence gcloud execution through CLOUDSDK_PYTHON Treat workspace environment loading as code-execution-adjacent when setup helpers launch cloud CLIs.
GHSA-ccwh-wwpp-6wg5 / CVE-2026-53864 OpenClaw environment sanitizer lower-trust env sources could pass Node.js control variables into later child processes Build env-sanitizer tests around runtime control variables, not just obvious credential names.
GHSA-q99w-vh6v-q3v7 / CVE-2026-53843 OpenClaw device sessions a pairing-scoped session could regain node WebSocket authority after node-token revocation Verify revocation boundaries with live session reuse and reconnect attempts, not only token deletion.
GHSA-985f-72mj-8gf7 / CVE-2026-53863 OpenClaw tool policy groups policy callers could resolve decisions for unvalidated group ids Test tool-policy routing when a caller can supply group, role, workspace, or channel identifiers.
GHSA-gcq2-9pq2-cxqm / CVE-2026-55603 http-proxy-middleware fixRequestBody() multipart reconstruction interpolated req.body keys/values without neutralizing CRLF Compare gateway-side parsed body validation with the exact wire body re-emitted to the backend.
GHSA-64mm-vxmg-q3vj / CVE-2026-55602 http-proxy-middleware router host+path proxy-table entries used substring matching over attacker-controlled Host plus URL Test host-header superstrings that steer traffic to unintended backends despite apparent route tables.
GHSA-2c85-rfcc-g74j Karate Mock Server request body, headers, or parameters assigned to variables could be recursively processed as Karate embedded expressions Treat mock/test servers as reachable execution surfaces when untrusted HTTP data crosses into expression evaluation.
GHSA-x9g3-xrwr-cwfg / CVE-2026-55388 Piscina worker pool inherited options.filename from polluted prototypes flowed into worker thread code loading Link prototype-pollution sources to downstream worker/import gadgets instead of stopping at object mutation.
GHSA-2mrg-35hw-x3x9 / CVE-2026-55229 Gotenberg LibreOffice conversion uploaded documents could trigger outbound resource fetches, and may reference local file resources during conversion Add document-converter SSRF/file-resource checks to render pipelines that accept DOCX/ODT/HTML-like inputs.
GHSA-mw9r-p8xp-wx96 / CVE-2026-55225 Strimzi Cluster Operator attacker-controlled Kafka.spec.entityOperator.*.watchedNamespace could create roles allowing secret CRUD in target namespaces Validate Kubernetes operators that convert custom-resource fields into RBAC in other namespaces.
GHSA-r427-j2h7-wv3m / CVE-2026-55226 Strimzi Entity Operator single-operator deployments still granted rights corresponding to the absent counterpart operator Check least-privilege assumptions when optional controllers are disabled but shared service accounts remain broad.
GHSA-6x8v-2fq5-2229 / CVE-2026-55670 ZITADEL user lifecycle recreating a deleted user id under another org could route events to the original org Probe tenant isolation where externally supplied or recycled object ids meet event-sourced ownership history.
GHSA-29jh-8cfq-rr8x / CVE-2026-55671 ZITADEL outbound HTTP components notification channels, OIDC backchannel logout, and SAML metadata fetches accepted user-defined URLs with redirect/rebinding/protocol denylist bypasses Treat IdP-admin URL fields as high-value SSRF sinks and validate redirect, DNS rebinding, and scheme downgrade controls with canaries.

Late PraisonAI and ZITADEL additions

Source: GitHub advisories published later in the same hourly window: GHSA-gcq3-mfvh-3x25, GHSA-p75f-6fp4-p57w, GHSA-x92v-rpx6-p6cw, GHSA-rh39-9c67-59mh, GHSA-892r-p3jq-jp24, GHSA-x8cv-xmq7-p8xp, GHSA-rjvw-7vvw-549v, GHSA-fq2m-6wqh-x44g, GHSA-2rcg-mm5h-xchx, GHSA-j4hj-7hfh-g2f4, GHSA-vxgj-xg5c-p4h7, GHSA-4869-x4pr-q22x, GHSA-p4pj-vh7h-6cqh, GHSA-x227-pf99-vffg, GHSA-pv2j-rghr-v5r9, GHSA-6h9p-93hq-q7h6, GHSA-w6h2-fr4q-xvxv, GHSA-v847-hxxw-3pxg, GHSA-63v4-w882-g4x2, GHSA-fc26-m9pf-v56q, GHSA-j7qx-p75m-wp7g, GHSA-qvpf-j64c-jmhr, GHSA-5qw8-f2g9-ff29, GHSA-vmf9-xx9w-86wx, GHSA-22cj-m4wf-fv2c, GHSA-8579-rgg5-ph2m, GHSA-35w5-pcw4-jx94, GHSA-g5h5-m4hm-xjrr / CVE-2026-55669, GHSA-wxg7-w2v3-w38g, and GHSA-xqxv-4jc2-x56x / CVE-2026-55672.

Advisory cluster Component Boundary Operator value
GHSA-p75f-6fp4-p57w, GHSA-4869-x4pr-q22x, GHSA-fq2m-6wqh-x44g, GHSA-892r-p3jq-jp24, GHSA-x8cv-xmq7-p8xp, GHSA-j4hj-7hfh-g2f4, GHSA-5qw8-f2g9-ff29 PraisonAI UI, Jobs API, AgentOS, AgentTeam, and recipe servers unauthenticated routes could connect MCP stdio commands, submit agent workflows, list/invoke agents, or expose recipe service functions Enumerate AI agent service routes for unauthenticated tool invocation before testing individual tool impact.
GHSA-v847-hxxw-3pxg, GHSA-63v4-w882-g4x2, GHSA-8579-rgg5-ph2m PraisonAI dangerous-tool approval paths policy enforcement could be skipped, approval pages rendered tool arguments as raw HTML, or unrelated Discord channel messages could approve dangerous tools Treat approval UX and chat-mediated approvals as privileged state machines; verify request binding, origin, and negative approval controls.
GHSA-gcq3-mfvh-3x25, GHSA-2rcg-mm5h-xchx, GHSA-p4pj-vh7h-6cqh, GHSA-j7qx-p75m-wp7g, GHSA-22cj-m4wf-fv2c PraisonAI code, file, dynamic-context, and artifact tools workspace roots, @file: mentions, agent_file, artifact storage, history, or terminal helpers could read or modify paths outside intended roots Build file-boundary tests around every agent-visible path abstraction, not only obvious upload/download endpoints.
GHSA-x227-pf99-vffg, GHSA-vmf9-xx9w-86wx, GHSA-35w5-pcw4-jx94 PraisonAI MCP/SSE transports SSE MCP servers or publish endpoints could bind broadly without auth/origin validation and expose registered tools or event injection Probe MCP transports as web attack surfaces: bind address, unauthenticated list/invoke, browser origin relay, and event-channel authorization.
GHSA-x92v-rpx6-p6cw, GHSA-fc26-m9pf-v56q, GHSA-qvpf-j64c-jmhr, GHSA-rh39-9c67-59mh PraisonAI webhook, bot, and platform API flows missing webhook secrets, Slack authorization bypasses, or ownership checks let lower-trust messages or users trigger trusted bot/platform actions Validate bot integrations with forged canary events, wrong-channel users, and cross-owner object ids before asserting command execution impact.
GHSA-rjvw-7vvw-549v, GHSA-vxgj-xg5c-p4h7, GHSA-6h9p-93hq-q7h6 PraisonAI Jobs, praisonaiagents, and SpiderTools outbound fetches SSRF guards could validate literal IPs or initial URLs but miss DNS rebinding, DNS resolution, or redirect targets Use owned redirector/DNS-rebind canaries and synthetic internal listeners; do not probe real internal services.
GHSA-pv2j-rghr-v5r9, GHSA-w6h2-fr4q-xvxv PraisonAI code execution and compute-bridged file tools sandbox/blocklist and compute bridge boundaries could be bypassed into attribute access or shell command construction Keep proofs to inert markers in isolated workers and avoid publishing payloads that are directly reusable against production hosts.
GHSA-g5h5-m4hm-xjrr / CVE-2026-55669, GHSA-wxg7-w2v3-w38g, GHSA-xqxv-4jc2-x56x / CVE-2026-55672 ZITADEL JWT IdP and OAuth/OIDC flows token audience/lifetime validation or authorization-code/refresh-token client binding could be missing under specific flow preconditions Add positive/negative OAuth canaries for aud, exp, iat, authorization-code client binding, and refresh-token client binding in multi-client IdP assessments.

Second June 18 advisory wave

Source: GitHub advisories published after the initial June 18 update: GHSA-cf98-j28v-49v6 / CVE-2026-55170, GHSA-j8cv-x86q-rj85 / CVE-2026-54695, GHSA-w5cv-pw74-4rxc / CVE-2026-55701, GHSA-4jvg-4jfx-fmhc / CVE-2026-47256, GHSA-whxw-24jc-cwmv / CVE-2026-54003, GHSA-r3w8-2c5r-h9j9 / CVE-2026-54005, GHSA-89cp-7p28-jffg / CVE-2026-54004, GHSA-4v4h-m2qq-ppgw / CVE-2026-50188, GHSA-rvp7-w75q-9fv2 / CVE-2026-12567, GHSA-m54h-vhf9-3w3m / CVE-2026-12568, GHSA-3mp7-vp6j-2mxx / CVE-2026-12566, GHSA-3vgw-585j-4m45 / CVE-2026-12565, GHSA-c226-q6fx-6j6c / CVE-2026-53861, GHSA-j99q-93c9-h869, GHSA-q6r4-3wmg-fwcq / CVE-2026-55686, GHSA-vmh5-mc38-953g / CVE-2026-9697, GHSA-p6gq-j5cr-w38f, GHSA-v4jc-pm6r-3vj8 / CVE-2026-47103, GHSA-cwj8-7gp2-ggcw, GHSA-6jcq-6546-qrrw, GHSA-8ccj-p46r-jwqq, GHSA-j4f3-55x4-r6q2, GHSA-4jgr-pg2m-m988, and GHSA-38x9-25wx-7fg2.

Advisory cluster Component Boundary Operator value
GHSA-cf98-j28v-49v6 / CVE-2026-55170 OpenFGA with MySQL authorization decisions depending on case-sensitive user strings could collide and return the same check result Add case-variant subject canaries to authorization testing when the datastore or query layer may normalize identifiers differently than the policy model.
GHSA-j8cv-x86q-rj85 / CVE-2026-54695 Pipecat development telephony runner unauthenticated /ws telephony test endpoint accepted attacker-supplied call SIDs and used operator Twilio credentials for call-control actions Treat exposed AI/voice development runners as control-plane endpoints; prove only with owned Twilio/test call IDs and route-level canaries.
GHSA-w5cv-pw74-4rxc / CVE-2026-55701, GHSA-4jvg-4jfx-fmhc / CVE-2026-47256 OpenTelemetry Collector contrib githubreceiver and sentryexporter configured webhook required_headers were not enforced, and attacker-controlled service.name could traverse Sentry API paths while carrying the operator bearer token Validate telemetry receivers/exporters as privileged relays: webhook header gates, tenant/project path construction, and token attachment to attacker-influenced outbound API calls.
GHSA-whxw-24jc-cwmv / CVE-2026-54003, GHSA-r3w8-2c5r-h9j9 / CVE-2026-54005, GHSA-89cp-7p28-jffg / CVE-2026-54004, GHSA-4v4h-m2qq-ppgw / CVE-2026-50188 Kirby CMS reverse-proxy client-IP headers could permit first-admin Panel initialization, API routes could ignore page/file access controls, and remote HTTP helpers could inject headers Test CMS admin bootstrap, content APIs, and outbound HTTP helpers where proxy trust, role blueprints, draft visibility, and request header construction meet lower-trust input.
GHSA-rvp7-w75q-9fv2 / CVE-2026-12567, GHSA-m54h-vhf9-3w3m / CVE-2026-12568, GHSA-3mp7-vp6j-2mxx / CVE-2026-12566, GHSA-3vgw-585j-4m45 / CVE-2026-12565 BBOT modules recon scanner modules followed symlinks, trusted Postman workspace names for paths, accepted Docker registry auth realms for outbound requests, or delegated archive safety to platform tar behavior Add scanner-ingestion safety tests for module outputs, archive extraction, registry authentication challenges, and user-controlled names before running tools against untrusted corpora.
GHSA-c226-q6fx-6j6c / CVE-2026-53861 and adjacent PraisonAI advisories OpenClaw and PraisonAI command/auth/sandbox paths combined POSIX flags, hardcoded/default secrets, auth-disable environment toggles, sandbox fallback, MCP HTTP tool exposure, and approval-order issues could cross intended operator policy boundaries Re-test every alternate command syntax, deployment default, environment flag, and sandbox fallback as a separate path; do not assume one approval or auth check covers all transports.
GHSA-j99q-93c9-h869 MCPVault PathFilter case-insensitive filesystems and trailing dot/space equivalence bypassed restricted-directory deny lists such as .git, .obsidian, or node_modules On macOS/Windows agent vaults, validate path filters with OS-canonical segment variants, not only normalized POSIX-style paths.
GHSA-q6r4-3wmg-fwcq / CVE-2026-55686 Podman image WORKDIR handling malicious image metadata with symlinked WORKDIR paths could create or mutate host-side paths during container setup Add image-metadata-to-host-filesystem checks to container runtime assessments using disposable host directories only.
GHSA-vmh5-mc38-953g / CVE-2026-9697 undici SOCKS5 ProxyAgent configured HTTPS pinning options in requestTls were dropped for SOCKS proxy tunnels Test outbound clients through every configured proxy scheme; record certificate trust anchors and SNI behavior with lab CAs rather than assuming direct-client TLS policy survives proxy wrapping.
GHSA-p6gq-j5cr-w38f Nodemailer message-level raw option message-level raw content bypassed disableFileAccess / disableUrlAccess, enabling file or URL-backed message content when applications passed untrusted mail data In email-generation bug hunts, test all content node types and raw-message escape hatches against file/URL access guards with synthetic files and owned callbacks.
GHSA-v4jc-pm6r-3vj8 / CVE-2026-47103 python-statemachine SCXML processor attacker-controlled <data expr> attributes were evaluated with Python eval() during SCXML parsing Treat workflow/state-machine import formats as code-adjacent; prove with inert expression markers in isolated parsers only.
GHSA-4jgr-pg2m-m988, GHSA-38x9-25wx-7fg2 Heimdall proxy mode unsanitized Host or malformed forwarding headers crossed into generated Forwarded headers and rule-pipeline client-IP decisions Validate identity-aware proxies with quoted, comma, semicolon, malformed, and obfuscated forwarding-header canaries against both rule decisions and upstream header emission.

Collector, scanner, CMS, and runtime validation boundaries

  • Telemetry relays: Use disposable GitHub webhook events and OTLP spans with synthetic service.name values. Positive evidence should be missing required-header enforcement or a callback/request to a canary Sentry path only; never attach production collector tokens or query real Sentry data.
  • CMS bootstrap and content APIs: In a lab Kirby install with no real users, vary reverse-proxy headers and role/page blueprint controls. Positive evidence is first-admin initialization reachability or canary page/file metadata returned to a user who lacks access.
  • Recon scanner ingestion: Run BBOT modules in a temp output directory against owned Postman workspaces, local archives, and a mock Docker registry. Evidence is path resolution, archive listing, or registry auth callback behavior; do not overwrite dotfiles, SSH keys, shell startup files, or real scan output.
  • Agent and MCP defaults: Check PraisonAI/OpenClaw defaults, env toggles, MCP HTTP binding, sandbox availability, and approval order in isolated workers with inert tools. Evidence should be auth bypass, wrong policy branch, or marker execution only.
  • Runtime import and mail/render escape hatches: For Podman, Nodemailer, python-statemachine, undici, and MCPVault, use disposable images, synthetic files, lab CA certificates, and canary paths to demonstrate metadata-to-host, raw-message-to-resource, SCXML-to-eval, SOCKS-to-TLS-policy, or path-filter-to-OS-canonicalization gaps.

Third June 18 advisory wave

Source: GitHub advisories published after the second June 18 update: GHSA-wm69-2pc3-rmmf, GHSA-r253-r9jw-qg44, GHSA-2jq4-q6vv-4cp3, GHSA-qqf5-x7mj-v43p, GHSA-gfj5-979r-92pw, GHSA-hgw6-8c77-v4gq / CVE-2026-11752, GHSA-hxpf-9xvq-wph8, GHSA-fq4x-789w-jg5h, GHSA-hjwc-26pj-v3pm, and GHSA-jr45-52cw-69h5 / CVE-2026-54683.

Advisory cluster Component Boundary Operator value
GHSA-wm69-2pc3-rmmf, GHSA-r253-r9jw-qg44, GHSA-2jq4-q6vv-4cp3 Crawl4AI Docker API and crawler downloads unauthenticated crawl routes accepted URLs, Chromium launch flags, or download filenames that crossed into server-side fetches, container command execution, or filesystem writes outside the downloads root Treat exposed crawler/AI-browser services as privileged automation surfaces: test stream vs non-stream route parity, request-controlled browser flags, and download path confinement with inert canaries.
GHSA-qqf5-x7mj-v43p Budibase database connectors administrator-controlled schema/table connector configuration was interpolated into PostgreSQL, MSSQL, or MySQL introspection SQL Revisit low-code datasource setup flows where builder/admin input becomes raw connector SQL; scope proofs to disposable schemas and marker queries only.
GHSA-gfj5-979r-92pw @acastellon/auth middleware service-to-service bypass trusted client-controlled auth-user and Host headers before token validation Add spoofed service-header and host-header canaries to middleware assessments, especially when downstream services trust identity headers.
GHSA-hgw6-8c77-v4gq / CVE-2026-11752 Armeria xDS SDS DataSource control-plane supplied filenames or environment-variable names were resolved by xDS clients as TLS material without allowlist or base-directory confinement In service-mesh reviews, test whether semi-trusted control-plane data can steer clients into local file/env reads; use synthetic mounted key files only.
GHSA-hxpf-9xvq-wph8 netlicensing-mcp product tool caller-controlled REST path segment normalized through ../token, bypassing token-specific redaction wrappers Validate MCP tools that interpolate path parameters before generic response serialization; prove with redaction canaries, not live API keys.
GHSA-fq4x-789w-jg5h, GHSA-hjwc-26pj-v3pm AgenticMail inbound-mail bridge and task API unauthenticated inbound mail could resume an operator Claude Code session in bypass-permissions mode, and authenticated agents could enumerate/claim/complete other agents' tasks by assignee/task id Treat email-to-agent bridges and task queues as authorization boundaries; verify sender provenance, prompt injection into privileged sessions, task-id capability secrecy, and cross-agent mutation controls with owned accounts and inert tasks.
GHSA-jr45-52cw-69h5 / CVE-2026-54683 NL Portal document APIs document-content endpoints remained object-id-only downloads for any logged-in user after an incomplete prior fix For IDOR regression testing, check every alternate route family and fixed-version claim with synthetic documents owned by separate lab users.

Crawler and AI-browser service boundaries

  • Inventory every exposed Crawl4AI route in scope: /crawl, /crawl/stream, and /crawl/job, including flags such as crawler_config.stream=true that switch handlers.
  • For SSRF checks, use only owned callback URLs and lab-local synthetic HTTP services. Positive proof is a callback or streamed marker body from the controlled canary service; do not request cloud metadata, RFC1918 production hosts, service discovery, or admin panels.
  • For browser launch controls, submit request-supplied browser_config.extra_args containing only inert marker flags in an isolated container. Evidence should show whether untrusted flags reach Chromium launch construction; do not execute commands on production runners.
  • For download path confinement, serve a file from owned infrastructure with a traversal-like or absolute-looking filename that writes only a disposable marker under a lab temp directory. Never overwrite shell startup files, SSH keys, cron entries, application modules, or mounted secrets.

Low-code, auth-header, xDS, and MCP path boundaries

  • For Budibase connectors, create disposable PostgreSQL/MSSQL/MySQL schemas and connector configs with harmless quote/identifier canaries. Evidence is connector-generated SQL or a marker query result; do not alter production data or enable database OS-command features.
  • For auth middleware, pair spoofed auth-user, Host, and downstream is-* header attempts with negative controls using valid/invalid tokens and untrusted hostnames. Report only route reachability and identity-claim confusion.
  • For xDS SDS, use a lab xDS control plane and synthetic files/env vars containing non-secret markers. Positive proof is the client attempting to consume marker bytes as configured key/cert/CA data, never real private keys or service-account tokens.
  • For MCP REST tools, fuzz path parameters containing encoded slashes, dot segments, and normalization variants against mocked APIs where secret-like values are fake and redaction behavior is observable.

Mail-to-agent and task-queue boundaries

  • Send inbound mail from owned external accounts to a lab bridge and verify whether sender provenance is checked before any privileged resume, tool invocation, or bypassPermissions mode change.
  • Keep prompt-injection content inert: fixed markers and requests to write only under a disposable workspace. Do not ask the resumed agent to exfiltrate secrets, read home directories, or access real OAuth resources.
  • For cross-agent task APIs, create two lab agents, seed synthetic tasks, and test whether one agent can list, claim, complete, fail, or submit results for the other's task ids.
  • Evidence should include authenticated principal, target assignee/task id, route, and state transition. Do not collect tenant task payloads or production mailbox content.

Fourth June 18 OpenClaw policy-state wave

Source: GitHub advisories published after the third June 18 update: GHSA-68xw-r643-9p5w / CVE-2026-53845, GHSA-x629-46cc-7xgw / CVE-2026-53847, GHSA-w9hf-3pp7-pvxv / CVE-2026-53841, GHSA-fcvx-5cxc-v5p8 / CVE-2026-53851, GHSA-9v8j-9c9g-w66c / CVE-2026-53862, GHSA-5cj2-3jr2-5h77 / CVE-2026-53855, GHSA-gxg4-2rrr-jhc7 / CVE-2026-53859, and GHSA-cwpp-5962-q4f6 / CVE-2026-53848.

Advisory cluster Component Boundary Operator value
GHSA-68xw-r643-9p5w / CVE-2026-53845 OpenClaw skill-command dispatch skill-command paths could skip before-tool-call hooks that normally enforce policy before execution Treat every tool invocation syntax as a separate policy boundary; verify hooks fire for slash commands, skill commands, direct tool calls, and chat-mediated dispatch.
GHSA-x629-46cc-7xgw / CVE-2026-53847 OpenClaw Active Memory write-scope controls could mutate global configuration instead of staying inside the intended memory scope Treat agent memory tools as policy-state mutation surfaces; test project, user, and global config boundaries with inert marker keys.
GHSA-w9hf-3pp7-pvxv / CVE-2026-53841 OpenClaw session export exported HTML sessions could preserve unsafe markdown links from lower-trust chat content Include export/share artifacts in agent UI testing, not just the live chat renderer; prove with harmless javascript:-style or external-link canaries only.
GHSA-fcvx-5cxc-v5p8 / CVE-2026-53851 OpenClaw Slack reaction handling reaction-triggered automation could ignore configured notification or reaction settings Validate chatops reaction paths as action triggers with negative controls for disabled reactions, wrong emoji, wrong channel, and wrong actor.
GHSA-9v8j-9c9g-w66c / CVE-2026-53862 OpenClaw bootstrap pairing replayed bootstrap tokens could widen pending pairing scopes Exercise pairing-token replay, scope narrowing, and pending-device transitions before treating bootstrap as one-time or least-privilege.
GHSA-5cj2-3jr2-5h77 / CVE-2026-53855, GHSA-cwpp-5962-q4f6 / CVE-2026-53848 OpenClaw shell policy positional parameters or transparent command wrappers could weaken inline-eval and exec allowlist enforcement Test every shell spelling that reaches the same execution sink: positional args, wrappers, aliases, compact flags, and inline forms.
GHSA-gxg4-2rrr-jhc7 / CVE-2026-53859 OpenClaw hostname checks trailing-dot hostnames could be normalized inconsistently across allowlist or trust decisions Add DNS canonicalization canaries to agent callbacks, webhooks, and remote-tool host allowlists, including trailing dots and case variants.

OpenClaw replay boundaries

  • Use an isolated OpenClaw workspace with no real Slack, cloud, or production MCP credentials loaded.
  • For memory/global-config tests, write only synthetic marker keys and verify whether project-scoped tools can mutate user/global settings; do not alter real approvals, credentials, or shell profiles.
  • For exported-session rendering, use inert link canaries and capture only the generated HTML/link target. Do not embed credential-bearing URLs or browser exploit payloads.
  • For chatops reactions and pairing flows, use lab Slack channels/devices and record actor, channel, token age, requested scope, and final action state.
  • For before-tool-call hooks, register a lab hook that records a synthetic marker and blocks a harmless denied command. Exercise slash commands, skill commands, direct tool calls, and chat-triggered dispatch separately.
  • For shell and hostname controls, keep proofs to blocked/allowed decision tables plus marker command construction; do not execute destructive commands or probe third-party hosts.

Fifth June 18 OpenClaw, MCP, JWT, OTP, and Signal K wave

Source: GitHub advisories published after the fourth June 18 update: GHSA-q59x-jc9f-gfqf / CVE-2026-55591, GHSA-5739-39v2-5754, GHSA-jc38-x7x8-2xc8, GHSA-3prj-6hqw-cm82, GHSA-6vvh-pxr4-25r7, GHSA-2jx3-65f3-xr8r, GHSA-g7m4-839x-ch6v, GHSA-4h5r-5jm8-jxjm / CVE-2026-0755, GHSA-4hpg-mp64-x7xq / CVE-2026-53854, GHSA-8mg9-j9cf-54cj / CVE-2026-53852, GHSA-rx78-29qr-5hq8 / CVE-2026-53865, GHSA-wc84-j36w-pw4x / CVE-2026-53858, GHSA-cw4q-gqg5-g38h / CVE-2026-53856, GHSA-mpc8-jxjh-qpgh / CVE-2026-53849, GHSA-24vr-rprv-67rf / CVE-2026-53857, GHSA-v2ww-5rh7-2h5v / CVE-2026-53860, GHSA-8j37-5w68-wj2g / CVE-2026-53850, GHSA-72fw-cqh5-f324 / CVE-2026-53844, GHSA-rwp6-7w3q-75fq / CVE-2026-53853, and GHSA-8c59-hr4w-qg69 / CVE-2026-53846.

Advisory cluster Component Boundary Operator value
GHSA-q59x-jc9f-gfqf / CVE-2026-55591 Signal K Server remote connections user-configured remote endpoint URLs could force the server to fetch arbitrary HTTP(S) targets Treat operational/IoT connector URL fields as SSRF sinks; prove only with owned callbacks and synthetic lab-local listeners.
GHSA-jc38-x7x8-2xc8, GHSA-6vvh-pxr4-25r7, GHSA-5739-39v2-5754 PHP JWT Framework / Library JOSE algorithm, key-wrap, or RSA decryption choices crossed from attacker-controlled token headers/ciphertexts into verifier/decryptor behavior Add JWT/JWE parser tests for protected-vs-unprotected header precedence, authenticated key-wrap tags, and padding-oracle response classes using disposable keys only.
GHSA-2jx3-65f3-xr8r spomky-labs/otphp provisioning URI import untrusted OTP provisioning URI parameters could mass-assign internal state before token generation In account-enrollment flows, test whether QR/provisioning URI fields can alter issuer, digits, algorithm, counter, period, or secret handling beyond documented inputs.
GHSA-4h5r-5jm8-jxjm / CVE-2026-0755 gemini-mcp-tool prompt execution bridge quoted prompt material and @file references could cross into shell execution or local file disclosure when the MCP tool invokes Gemini CLI Assess MCP wrappers around local CLIs as command-construction boundaries; keep proofs to inert markers and disposable files, never real project secrets.
GHSA-4hpg-mp64-x7xq, GHSA-cw4q-gqg5-g38h, GHSA-8j37-5w68-wj2g, GHSA-8c59-hr4w-qg69 OpenClaw internal/webchat and chat allowFrom policy wildcard owner state or mutable display/conversation identifiers could authorize lower-trust chat/web actors Verify chat authorization against immutable ids plus negative controls for renamed users, display-name collisions, changed conversations, and wildcard owner state.
GHSA-rx78-29qr-5hq8, GHSA-wc84-j36w-pw4x, GHSA-24vr-rprv-67rf OpenClaw workspace environment and PATH handling workspace-derived PATH, STATE_DIRECTORY, or npm_execpath could steer service cleanup or bundled dependency installation Treat repository .env and service environment as code-loading inputs; test with temp PATH/npm/runtime canaries and avoid touching real package caches or system binaries.
GHSA-v2ww-5rh7-2h5v, GHSA-mpc8-jxjh-qpgh, GHSA-8mg9-j9cf-54cj OpenClaw exec, focus, and pairing controls configured argument patterns, control-scope checks, or empty-scope re-pairing could be skipped under alternate command/session paths Build decision-table tests for every OS command spelling, focus/control-scope route, and re-pairing scope transition before trusting a single approval result.
GHSA-72fw-cqh5-f324, GHSA-rwp6-7w3q-75fq OpenClaw memory-wiki and config recovery shared search visibility or recovered config file permissions could cross from private/session state into broader readable state Include recovery and shared-search paths in agent data-boundary tests; evidence should be marker visibility or mode bits only, not real memory contents.

JWT, OTP, MCP-wrapper, and chat-policy validation boundaries

  • For JWT/JWE libraries, generate disposable keys and tokens locally. Vary protected vs unprotected headers, algorithm identifiers, key-wrap tags, and malformed RSA1_5 ciphertexts while recording only accept/reject/error-class differences; do not attack production token services or user sessions.
  • For OTP provisioning, seed lab enrollment flows with synthetic otpauth:// URIs and verify which fields are accepted into server-side state. Do not enroll real MFA devices or alter live user factors.
  • For MCP CLI wrappers, use a throwaway workspace with fake @file targets and marker prompts. Positive proof is command construction or marker file access only; never request shell history, keys, source secrets, cloud config, or production files.
  • For Signal K and agent/chat policies, keep callbacks and identities lab-owned. Test URL redirects/rebinding only against controlled listeners and chat authorization only with disposable users/channels/devices.

Sixth June 18 SSRF-filter and config-server update wave

Source: GitHub advisories updated after the fifth June 18 update: GHSA-8p33-q827-ghj5 / CVE-2026-44232 and GHSA-86wq-234q-r6wg / CVE-2026-41002.

Advisory cluster Component Boundary Operator value
GHSA-8p33-q827-ghj5 / CVE-2026-44232 dssrf URL safety filter IPv6 loopback, ULA, link-local, IPv4-mapped, NAT64, SRv6, and deprecated site-local forms could be classified differently from equivalent blocked IPv4 destinations Expand SSRF allowlist/denylist tests beyond literal IPv4 and hostname cases; include bracketed IPv6, mapped IPv4, NAT64 translation prefixes, redirects, and post-DNS canonicalization canaries.
GHSA-86wq-234q-r6wg / CVE-2026-41002 Spring Cloud Config Server Git clone base directory repository clone base-directory checks could race with filesystem changes between validation and use In config-server assessments, treat Git-backed repository materialization as a filesystem boundary; use disposable basedirs and symlink/swap canaries to validate clone-root confinement without touching production config or secrets.

SSRF canonicalization and config materialization boundaries

  • For SSRF filters, build a local harness that calls the exact deployed validator and outbound HTTP client. Test loopback/private equivalents across http://[::1]/, http://[fc00::1]/, http://[fe80::1]/, IPv4-mapped forms such as http://[::ffff:127.0.0.1]/, NAT64 prefixes, trailing dots, redirects, and DNS rebinding only against owned listeners.
  • Evidence should show the validator decision, the normalized destination, and whether the outbound client attempted the canary request. Do not query cloud metadata, internal production hosts, service discovery, or admin interfaces.
  • For Spring Cloud Config Server, use an isolated instance, synthetic Git repositories, and temp clone roots. Positive proof is clone/root materialization outside the intended basedir via a marker directory or symlink/swap race; never read live application configuration, credentials, or Kubernetes service-account tokens.
  • Pair positive tests with patched-version or hardened-wrapper negative controls, and report the crossed boundary as URL canonicalization to SSRF filter bypass or Git clone basedir check to filesystem race.

Seventh June 18 sandbox and PraisonAI default-boundary update

Source: GitHub advisories published after the SSRF-filter update wave: GHSA-fjv8-j4p5-cr9m, GHSA-2fjj-qqg8-fg7x, GHSA-4pcv-mg8v-vrgf, GHSA-f38v-77qj-h4jq, GHSA-29w3-p9w9-wc47, GHSA-jxcw-qp4h-6jfq, GHSA-7qw2-w5rc-37x2, GHSA-5jv7-2mjm-h6qj, GHSA-h2w2-v7j6-xqm4, GHSA-9752-mhqh-h34f, GHSA-p69m-4f92-2v84, GHSA-vjv9-7m7j-h833, GHSA-vmmj-pfw7-fjwp, GHSA-gqmf-56h7-rrpf, GHSA-4qq2-2j2x-x62c, GHSA-c969-5x3p-vq3v, and GHSA-f44v-7qgw-9gh9.

Advisory cluster Component Boundary Operator value
GHSA-fjv8-j4p5-cr9m Daytona sandbox volume mounting attacker-controlled sandbox volume ids could traverse into arbitrary host paths and mount them into a sandbox, crossing tenant and host filesystem boundaries In developer-sandbox and agent-runner assessments, test whether volume ids, workspace ids, project ids, or mount aliases are canonicalized before host-path resolution.
GHSA-2fjj-qqg8-fg7x, GHSA-f38v-77qj-h4jq, GHSA-jxcw-qp4h-6jfq, GHSA-9752-mhqh-h34f, GHSA-4qq2-2j2x-x62c PraisonAI platform/API/auth defaults user-controlled keys, hardcoded/default JWT secrets, unauthenticated serve defaults, exposed AgentOS routes, or invalid Basic/OAuth credentials could cross into trusted agent listing or invocation Re-test agent-platform authentication as deployed: boot defaults, invalid tokens, unauthenticated list/invoke routes, and per-command auth toggles.
GHSA-29w3-p9w9-wc47, GHSA-f44v-7qgw-9gh9 PraisonAI file and template-cache tools multiedit tools or GitHub template cache paths could read/write outside intended roots or delete outside-cache directories Treat every agent file abstraction and template cache as a filesystem boundary; prove only with disposable marker files and directories.
GHSA-7qw2-w5rc-37x2, GHSA-5jv7-2mjm-h6qj, GHSA-h2w2-v7j6-xqm4, GHSA-p69m-4f92-2v84, GHSA-vjv9-7m7j-h833, GHSA-vmmj-pfw7-fjwp PraisonAI approval, wrapper, and sandbox execution paths recipe policy, safe-command wrappers, on-tool-call approval order, command allowlists, and JavaScript/Python sandbox controls could be bypassed or checked after execution Validate tool approval before execution and test every command/sandbox spelling with inert markers in isolated workers.
GHSA-4pcv-mg8v-vrgf, GHSA-gqmf-56h7-rrpf, GHSA-c969-5x3p-vq3v PraisonAI outbound search/network and IMAP tools caller-supplied search backend URLs, network-isolation assumptions, or email search parameters could steer SSRF or command construction Keep proofs to owned callback URLs, mock mailboxes, and non-proxy-aware canary clients; never query internal services or production mail stores.

Sandbox and PraisonAI default validation boundaries

  • Use only isolated Daytona/PraisonAI deployments or equivalent lab agent runners with disposable host directories, mock tools, and no production tokens loaded.
  • For sandbox volume ids, create two synthetic host canaries: one inside the intended volume root and one outside it under a temp directory. Test encoded dot segments, absolute-looking ids, repeated separators, and symlinked volume roots only against those markers.
  • For auth/default checks, boot a fresh lab service and record route, auth state, token type, and whether a harmless agent/tool list or inert invocation succeeds. Do not use real operator API keys or live tenant data.
  • For file/cache tools, write and read only marker files under temp roots and adjacent disposable out-of-root canary directories. Do not mount /, home directories, Docker sockets, cloud credentials, SSH keys, source repositories, production workspaces, or other tenants' data.
  • For approval, wrapper, sandbox, search, network, and IMAP tools, use inert commands, owned callbacks, mock mailboxes, and patched-version negative controls. Report crossed boundaries such as sandbox volume id to host path mount, default agent auth to tool invocation, agent file tool to out-of-root write, or search backend URL to SSRF guard bypass.

Eighth June 18 model-parser, CMS, notebook, cache, and sanitizer wave

Source: GitHub advisories published after the seventh June 18 update: GHSA-x5mv-8wgw-29hg / CVE-2026-55093, GHSA-wr9h-4r83-f4v6 / CVE-2026-54002, GHSA-rhj6-r49h-5932 / CVE-2026-49276, GHSA-23q2-54qv-rq5x / CVE-2026-49274, GHSA-fcw5-x6j4-ccmp / CVE-2026-44727, GHSA-pmf8-g7c8-7v54 / CVE-2026-55890, GHSA-2f86-9cp8-6hcf / CVE-2026-55885, GHSA-pr7r-676h-xcf6 / CVE-2026-9678, and GHSA-cmwh-pvxp-8882.

Advisory cluster Component Boundary Operator value
GHSA-x5mv-8wgw-29hg / CVE-2026-55093 tract-nnef NNEF tensor parser model-supplied .dat tensor dimensions and byte counts could overflow during model load and drive out-of-bounds reads Add inert malformed-model fixtures to AI/ML supply-chain reviews where uploaded or marketplace models are parsed before trust is established.
GHSA-wr9h-4r83-f4v6 / CVE-2026-54002, GHSA-rhj6-r49h-5932 / CVE-2026-49276, GHSA-23q2-54qv-rq5x / CVE-2026-49274 Kirby CMS Panel and content helpers sanitized HTML/XML, writer-field content, and pages-picker parent selection crossed from editor-controlled content into trusted Panel rendering or access decisions In CMS bug hunts, pair content-sanitizer bypasses with role/blueprint negative controls and page-picker object-id checks, not just generic XSS payloads.
GHSA-fcw5-x6j4-ccmp / CVE-2026-44727 Jupyter Server nbconvert preview handlers notebook content converted to HTML could render without the expected sandbox CSP around exported output Treat notebook preview/export endpoints as active renderers; prove with harmless markup canaries in disposable notebooks and separate author/viewer lab users.
GHSA-pmf8-g7c8-7v54 / CVE-2026-55890, GHSA-2f86-9cp8-6hcf / CVE-2026-55885 Grav CMS media styling and admin backups Markdown image style parameters and backup archive generation crossed from content/admin workflows into trusted CSS rendering or credential-bearing archives Test CMS media renderers and backup endpoints as separate trust boundaries; keep evidence to CSS marker rendering and synthetic backup contents only.
GHSA-pr7r-676h-xcf6 / CVE-2026-9678 undici HTTP cache cache-key parsing could treat whitespace-modified requests differently from the shared-cache lookup expected by the application Add shared-cache canaries for whitespace, authority, path, and header normalization mismatches when Node services proxy or cache multi-user responses.
GHSA-cmwh-pvxp-8882 DOMPurify setConfig() persistent sanitizer configuration state could be polluted so later sanitization accepted attributes that should remain disallowed Test sanitizer state as mutable process-global policy: run attacker-controlled config calls before victim sanitization in the same worker and verify with inert attribute canaries.

Render, cache, and sanitizer validation boundaries

  • For AI model parsers, use only throwaway model files with synthetic tensor data. Evidence should be parser accept/reject behavior, crash class, or sanitizer bounds evidence in an isolated harness; do not load untrusted model code or production weights.
  • For Kirby, Grav, and Jupyter, create lab content with separate low-privilege author and viewer/admin accounts. Positive proof is marker rendering, missing sandbox attributes, or canary object metadata exposure only; do not collect real content, cookies, notebooks, backups, or account secrets.
  • For undici cache behavior, run a local service with two disposable users and synthetic cacheable responses. Vary whitespace and canonicalization in request targets/headers and report only marker response mix-ups.
  • For DOMPurify, build a same-process harness that calls setConfig() or equivalent app configuration paths before a victim sanitization call. Evidence should be a harmless attribute surviving unexpectedly, paired with a clean-process negative control.

Operator triage

  1. Start with control-plane composition. MCP gateways, agent workspaces, crawler/AI-browser servers, mail-to-agent bridges, Kubernetes operators, identity providers, chatops bridges, proxy layers, token parsers, SSRF filters, Git-backed config servers, IoT/operations connectors, AI model parsers, CMS renderers, notebook exporters, shared HTTP caches, and sanitizer configuration surfaces are high-value because a small parsing or routing mistake can cross into host execution, cross-tenant access, backend trust, filesystem access, cryptographic acceptance, cross-user content disclosure, or trusted rendering.
  2. Confirm reachability before impact. The strongest cases require a lower-trust actor controlling an OCI label, repository workspace file, request body, Host header, document upload, custom resource, or IdP URL setting that is actually consumed by the vulnerable code path.
  3. Use synthetic canaries only. Prove with disposable images, workspaces, request fields, backend route markers, mock server variables, prototype-pollution lab objects, document URLs, Kubernetes namespaces, and identity-provider test users. Do not mount real host secrets, exfiltrate tokens, collect tenant data, or query internal production services.
  4. Keep negative controls explicit. Pair every positive with a patched build, rejected route, absent outbound callback, denied RBAC, sanitized environment, or revocation reconnect failure.

Replayable validation boundaries

MCP image metadata to container-launch flags

  • Build a disposable OCI image in a lab registry with an inert io.docker.server.metadata label that attempts only harmless runtime shaping, such as adding a canary environment variable or mounting an empty temp directory.
  • Reference the image through the affected gateway path (docker:// or catalog snapshot) in a lab gateway with no production credentials loaded.
  • Positive proof is that label-controlled YAML changes the constructed container launch arguments beyond descriptive metadata.
  • Do not mount /, home directories, Docker sockets, SSH keys, cloud credentials, or production workspaces.

Agent workspace environment and command-policy boundaries

  • Seed a disposable repository with .env markers for environment variables that should not cross into cloud CLI or Node.js child-process launches.
  • Exercise the affected setup/helper path and record only whether a benign marker runtime or output path was selected.
  • Test all command syntaxes separately: long-form commands, inline shell forms, plugin-dispatched commands, and any grouped tool route.
  • For revocation, keep an already paired lab device session alive, revoke the node token, and verify whether reconnect or WebSocket authority returns without a fresh approval.

PraisonAI service, MCP, and approval boundaries

  • Inventory every exposed PraisonAI web surface in scope: UI API, Jobs API, AgentOS, AgentTeam launch endpoints, recipe servers, MCP stdio-connect routes, MCP/SSE transports, webhook receivers, bot adapters, and approval dashboards.
  • For unauthenticated invocation checks, use only inert tools or commands that write a lab marker under a disposable temp directory. Capture route, request id, authenticated/unauthenticated state, and whether the tool invocation reached the server-side runner.
  • For approval flows, submit a harmless dangerous-tool request with a canary argument. Verify whether HTML rendering, unrelated chat messages, or skipped policy paths can flip the approval state without the intended reviewer decision.
  • For file tools, seed a synthetic workspace/artifact root and a separate canary file outside it. Positive proof is only path-resolution evidence or reading a disposable marker, never real host files, keys, project secrets, shell history, cloud credentials, or user data.
  • For MCP/SSE and event channels, test bind address, Origin, Host, unauthenticated list/invoke, and publish semantics from a lab browser and a direct HTTP client. Keep all registered tools inert.
  • For webhook and bot adapters, send forged canary events from owned accounts/channels with and without configured secrets; verify only whether the event enters the trusted workflow.

Agent SSRF and outbound-fetch guard boundaries

  • Use owned callback infrastructure plus an optional lab-only DNS rebinding host to test whether guards validate the final resolved address and post-redirect target, not only the initial literal URL.
  • Pair each positive callback with negative controls for blocked literal private IPs, blocked redirected private targets, and denied rebinding targets on patched builds.
  • Do not request cloud metadata, service-discovery endpoints, RFC1918 production ranges, admin panels, or customer internal services.

Multipart body re-emission and proxy router boundary

  • Put a controlled backend behind http-proxy-middleware and enable the exact fixRequestBody() or router configuration under test.
  • For multipart re-emission, send a value containing CRLF plus a harmless extra field marker. Compare what the gateway parsed and validated with what the backend received on the wire.
  • For router matching, configure a host+path proxy-table entry and send Host superstrings that include the configured key inside a longer attacker-controlled host.
  • Evidence should be backend route/field canaries only. Do not target real upstream admin, payment, identity, or metadata services.

Mock-server expression evaluation

  • Confirm the Karate Mock Server feature file assigns request-derived values such as request, requestHeaders, or requestParams into variables that undergo embedded-expression processing.
  • Use a harmless expression canary in a header, query parameter, or body field that returns a fixed marker; do not execute OS commands in shared environments.
  • Positive proof is server-side evaluation of data that arrived over HTTP and was not present in the feature file.
  • Scope impact to the mock server process privileges and lab configuration.

Prototype-pollution source to Piscina worker gadget

  • In a local harness, use a known prototype-pollution source to set only Object.prototype.filename to an inert .mjs canary under a temp directory.
  • Call the affected Piscina constructor or run() path with options that lack an own filename property.
  • Positive proof is loading of the inherited canary worker filename; negative proof is patched own-property validation or null-prototype option handling.
  • Do not chain this against production services or load untrusted code.

Document converter outbound and local-resource boundary

  • Upload a synthetic DOCX/ODT to a lab Gotenberg /forms/libreoffice/convert endpoint containing an image/resource URL on infrastructure you own.
  • Capture only the outbound canary request and conversion metadata. If local resource behavior is in scope, use a disposable file created inside the lab container.
  • Do not probe cloud metadata, RFC1918 ranges, admin panels, service discovery endpoints, real local files, or shared document stores.

Kubernetes operator custom-resource to RBAC boundary

  • Use a disposable cluster or namespace pair. Confirm the service account running the operator has permissions only in the intended test namespaces.
  • Create a Kafka custom resource with entityOperator watched namespace fields pointing at a canary namespace and inspect the resulting Role/RoleBinding and service account token capabilities.
  • Positive proof is unexpected Secret CRUD or cross-namespace access to synthetic secrets created for the test.
  • Never read production Secrets, service-account tokens, cluster credentials, or tenant namespaces.

Identity-provider tenant and outbound URL boundary

  • For recycled identifiers, create and delete only synthetic users, then recreate the same id under a second lab org and observe whether ownership/events route to the original org.
  • For outbound URL sinks, configure notification, OIDC backchannel logout, or SAML metadata URL fields with owned callback URLs that test redirect, DNS rebinding, and HTTPS-to-HTTP downgrade behavior.
  • For JWT IdP/OIDC client binding, use disposable clients and users. Attempt only synthetic token/code/refresh-token swaps across two lab clients and record whether aud, exp, iat, authorization-code client id, and refresh-token client id are enforced.
  • Positive proof is a cross-org canary association, a denied-network bypass callback to infrastructure you control, or a token/code accepted by the wrong lab client under documented preconditions.
  • Do not target internal hosts, metadata services, real users, or production tenant objects.

October 1 follow-up: Piscina ThreadPool.options execArgv/loadBalancer/env gadget set (1 critical GHSA)

GHSA-67c8-pqhq-4rmx / CVE-2026-102992 (critical; fixed piscina 5.3.2 / 4.9.4 / 6.0.0-rc.5) escalates the June filename gadget above into full worker RCE. ThreadPool.options is built as a plain object ({ ...kDefaultOptions, ...options, filename, maxQueue: 0 }), so every option that lacks an explicit own default — execArgv, env, loadBalancer, argv, workerData, resourceLimits, niceIncrement, closeTimeout, recordTiming, stricterFIFO, workerHistogram, trackUnmanagedFds — is prototype-reachable. The decisive gadget: Object.prototype.execArgv = ['--require', '/tmp/attacker.js'] makes every spawned worker preload and execute the attacker module; loadBalancer pollution invokes an arbitrary function during task scheduling, and env pollution injects variables into every worker process.

Operator value: the audit rule sharpens from "does an inherited option reach worker code loading?" to "enumerate which resolved-option keys have no own default — the gap set is the gadget surface." A single prototype-pollution primitive in any merge/parse helper of the app now lands on the highest-impact pool knobs, not just filename. For Node worker-pool assessments (piscina and any pool that spreads user/task options into a plain object passed to new Worker): (1) locate the resolved-options object and list keys present only via the prototype chain at spawn time; (2) prove with one inert gadget only — set Object.prototype.execArgv to ['--require', <temp-dir canary .mjs>] and confirm the canary's side-effect marker fires at worker start on a task call that supplies no options; (3) negative controls: patched piscina own-property/null-prototype option handling, and a pool call with explicit own execArgv (prototype must lose). Evidence: piscina version, pollution source call site, canary marker, worker-start timestamps. Do not use real shell payloads, persistence modules, or production pools.

Reporting heuristics

  • Title findings around the crossed boundary: OCI label to host container flags, workspace env to cloud CLI execution, inline shell parser to skipped allowlist, unauthenticated agent API to tool invocation, approval-page input to dangerous-tool approval, chat message to approval-state confusion, workspace path abstraction to out-of-root file read, MCP SSE transport to unauthenticated tool invoke, agent URL guard to redirected/rebound SSRF, revoked pairing session to restored node authority, parsed body to backend multipart injection, Host superstring to backend route bypass, HTTP request data to mock expression execution, prototype-polluted filename to worker import, document resource to converter SSRF, custom resource to cross-namespace Secret RBAC, IdP URL setting to denylist bypass SSRF, or OIDC code/token accepted by wrong client.
  • Keep impact bounded by observed canaries. Avoid claiming host compromise, cluster takeover, tenant breach, or credential theft unless the customer explicitly approved that proof and the synthetic evidence demonstrates the same path.
  • Include exact versions, route/config snippets, the lower-trust input, the privileged consumer, positive and negative controls, and redacted request/response or Kubernetes object evidence.

Notes on skipped adjacent items

The same scan rechecked Disclosed, PortSwigger research, Trail of Bits, ProjectDiscovery, GitHub advisory published/updated feeds, and CISA KEV. JLine Telnet resource exhaustion, NCalc factorial DoS, tract-nnef parser memory safety, pypdf stream-limit handling, generic or self-XSS-only rich-text issues, and availability-only WebSocket/client-fragment items were tracked in state but not promoted separately because the page above focuses on stronger replayable agent, proxy, render, CMS, scanner, Kubernetes, identity-provider, and runtime trust boundaries. The ProjectDiscovery RSS body hash changed without a new item in the top feed entries, and CISA KEV remained unchanged.