Skip to content

Infrastructure hard-coded trust defaults, CMS sandbox escapes, and framework fail-open authz: Central Dogma, mistral.rs, Pimcore, October CMS, Payload plugin, Shopper (12 GHSAs)

Source: hourly offensive-security scan, 2026-09-16 (GitHub advisories published 2026-09-10→14). Six product clusters that share one operator theme: a default, a fail-open flag, or a framework convenience silently replaces the security control you assume is active. All validation is lab-only with synthetic canaries and denied sinks; never test ISP/production infrastructure, decrypt retained data, or mutate live systems.

Boundary map

Advisory Product Boundary Operator value
GHSA-2j95-gqxf-v3vg / CVE-2026-11746 (critical) Central Dogma < 0.84.0 (replication.method=ZOOKEEPER) ZooKeeperReplicationConfig.secret() silently substitutes the OSS-public constant ch4n63m3 when replication.secret is omitted — no log, no warning — and the same secret authenticates both the ZK client-port super auth and the inter-peer quorum SASL on every embedded replica Canonical hard-coded-credential audit shape: public constant + silent fallback + dual-purpose use. For any HA Central Dogma (or similar embedded-quorum) deployment, the config-presence check (replication.secret set?) is the whole test; treat the default secret as a cluster-takeover primitive in authorized assessments.
GHSA-vjfw-cpmh-xwv3 / CVE-2026-11745 (high) Central Dogma Git mirror SshGitMirror installs serverKeyVerifier -> true unconditionally, disables known_hosts/ssh-config resolution, and exposes no pinning option — every git+ssh:// mirror blindly trusts the presented host key On-path/DNS-poisoning mirror-hijack audit: prove with a local fake SSH server presenting an ephemeral key and record that auth proceeds; stop before credential reuse. No operator opt-in exists, so absence-of-verification is a config-independent finding.
GHSA-98q5-5qh2-7w75 / CVE-2026-11748 (medium) Central Dogma Shiro SearchFirstActiveDirectoryRealm Login username interpolated into the LDAP filter template (cn={0}) with zero RFC 4515 escaping anywhere in the repo, plus setCountLimit(1): username * searches the directory and binds against the first entry (often privileged) with your password Reusable AD-backed app check: search-first realms that fetch a DN from user input without escaping turn the login form into a filter-injection oracle and an auth-confusion primitive. Prove with owned test OUs and timing/wildcard canaries; verify the deployment actually selects this realm (default Shiro realm is not affected).
GHSA-wfgq-w7cq-qj7j (high) mistral.rs ≤ 0.8.17 Vision/audio image_url/audio_url content is fetched with no host/IP validation and, worse, any bare existing path or file:// URL is opened and read server-side; redirects followed; server unauthenticated by default Contrast-and-audit pattern vs vLLM's allowed_media_domains/allowed_local_media_path gates: for any OpenAI-compatible inference server, test (1) owned-callback SSRF via image_url, (2) a synthetic local canary file path as a bare string, and (3) file:// scheme. Positive = canary bytes in the model response context; never read real config or key files.
GHSA-23rh-xw42-fq82 / CVE-2026-55416 (high, 8.8) Pimcore Custom Reports ≤ 2026.1.5 / 12.3.9 / 11.5.18 Report config fields (sql, from, where, groupby, plus uncast $offset/$limit in LIMIT) concatenated into SQL with only a keyword regex blacklist (ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE) that never blocks UNION SELECT, INSERT, LOAD_FILE(), INTO OUTFILE, comments, or subqueries Reusable heuristic: any admin-delegable "custom report/query builder" capability protected by a blocklist regex rather than parameterization is SQL injection with extra clicks. On authorized targets with reports_config, the read proof is a UNION SELECT of a synthetic marker; skip write/OUTFILE paths entirely.
GHSA-xv9m-fm3w-8w5x / CVE-2026-46696 (low) October CMS cms.safe_mode Laravel session store exposed to the Twig sandbox with unrestricted method access, and raw-SQL methods reachable through Eloquent __call forwarding were not blocked across the builder chain: markup editors can read arbitrary DB values and write the admin_auth session key to forge a superuser session Sandbox-pivot pattern for every framework-sandboxed template feature: enumerate objects handed to the sandbox (session stores, mailers, config) and the __call/forwarding magic that smuggles blocked methods past allowlists. Lab-only, safe-mode-enabled instance, disposable superuser row.
GHSA-2ff2-mx52-q8wp / CVE-2026-49400 (low) October CMS backend widgets (safe-mode only) Widget session state stored as base64(serialize()) and consumed with unrestricted unserialize() — PHP object injection when any path writes controllable bytes into a widget.* key Paired with the row above: sandbox-escape chains increasingly end in deserialization sinks inside the same trusted UI. Inventory unserialize/pickle sinks fed by session/cache storage in any audit of a sandboxed CMS.
GHSA-2xmm-m4wv-3fjh (low) October CMS image resizer Source classified by startsWith("http") and any string containing :// accepted as URL, so phar:///file:// wrappers reach the image library and trigger metadata deserialization Scheme-check-by-prefix fixture class: reuse for every "is this a URL?" branch (phar://x/y has no :// but reaches deserialization via existing phar files; file:// passes :// checks).
GHSA-4qpv-39hg-f7fx / CVE-2026-59965 (high) @jhb.software/payload-alt-text-plugin ≤ 0.7.0 (Payload CMS) Custom endpoints call the Payload Local API without overrideAccess: false; the framework resolves shouldOverrideAccess = overrideAccess !== false, so omitting the parameter means collection access functions are never called — any authenticated user reads/overwrites protected upload fields on arbitrary documents, with user-controlled id/collection in the body Framework fail-open default worth reusing everywhere: security-relevant flags that are opt-in-by-explicit-false. Audit pattern: grep every server-side Local/Internal API call in custom endpoints for the explicit-safe value; test pattern: low-privilege session + foreign synthetic document, expect read/write recorder hit.
GHSA-f7h9-qv4x-9x57 / CVE-2026-56826 Shopper shopper/framework Settings Livewire components shipped without authorization checks — browse-only staff reach privileged settings mutations Livewire/class-based-admin pattern below.
GHSA-99h5-jhh7-v3r3 / CVE-2026-56830 Shopper media sub-form store() still lacks authorization after a prior fix addressed sibling methods — incomplete-fix follow-up Re-run the original authorization matrix on every component method after any security fix; fixes that cover the reported method only are the common miss.
GHSA-5vf4-452p-jjhf / CVE-2026-56831 Shopper order pipeline Negative discount values accepted and propagated through order calculation Price-integrity boundary for bug hunters: exercise negative/zero/extreme numeric values on every discount/credit field; compare stored vs recomputed totals at the final order record.

Durable operator patterns

  1. Silent-fallback credential triad. When auditing config-driven infrastructure, look for the three-part amplification seen in Central Dogma: constant visible in OSS source, substituted silently when config is absent, and reused across two auth surfaces. The presence/absence of one config key becomes the whole authorized test.
  2. Fail-open-by-omission framework flags. Payload's overrideAccess !== false is a template for a whole bug class: any boolean security control whose safe value must be explicitly passed will be omitted by plugin authors. Fuzz custom endpoints with the lowest-privileged session you can mint and check whether protected-field recorders fire.
  3. Blocklist regex ≠ injection defense. Keyword blacklists around user-controlled SQL fragments are bypassable by design; on any authorized report-builder/BI capability, the test is which benign non-blocked construct (UNION SELECT of a canary) reaches the database, not which payloads slip through.
  4. Sandbox object inventory beats sandbox rule review. October CMS's bypasses came from what was inside the sandbox (session store, __call forwarding, deserialization-fed sinks), not from holes in the Twig policy. Enumerate reachable objects first, then methods.
  5. Media-loader parity checks on inference servers. mistral.rs proves the OpenAI-compatible surface itself is the SSRF/file-read primitive when fetch has no gate. Compare any vision/audio server against vLLM-style allowlists with owned callbacks, bare-path canaries, and scheme fixtures.

Authorized validation only

Use disposable Central Dogma replicas, safe-mode lab CMS instances, synthetic Payload documents and Shopper orders, fake inference servers, and owned callbacks. Never read real documents, forge live sessions on production hosts, or probe shared infrastructure.

Adjacent items tracked without publication