Management-plane config-write ladders, TOCTOU setup endpoints, and flat authz drift (Sept 21 21:31Z wave)¶

Source: hourly offensive-security scan, 2026-09-21. Primary entries: GitHub Advisory Database GHSA-pxcx-fv34-x9p5 / CVE-2026-61628 (nginx-ignition unauthenticated admin creation via onboarding race), GHSA-33h9-ppgm-5785 / CVE-2026-94571 and GHSA-xwpf-r3rp-gx2r / CVE-2026-94572 (OpenStack Octavia HAProxy config injection pair, both critical), GHSA-m78q-27gx-3rwr / CVE-2026-67827 (ZLMediaKit unauth config-write → shell execution), GHSA-m43c-83cc-q6q2 / CVE-2026-79317 and GHSA-x7jv-2m23-2ch3 / CVE-2026-79316 (x-ui session-invalidation + loopback-binding drift), and the nine-GHSA jshERP 3.6 authorization-drift cluster (GHSA-rv9h-p5p6-7pxh / CVE-2026-94411, GHSA-6h4x-56c2-qfmw / CVE-2026-94412, GHSA-w4x2-8gxc-hh47 / CVE-2026-94413, GHSA-73pr-pmq3-3g3w / CVE-2026-94494, GHSA-3chc-24g6-56gr / CVE-2026-94497, GHSA-pvxx-75wv-6w9m / CVE-2026-94501, GHSA-7rww-rvpx-33hf / CVE-2026-94414, GHSA-cx6j-h838-fr43 / CVE-2026-94495, GHSA-g2pg-97r2-r2p9 / CVE-2026-94496).

This wave is about the management panel itself as the target. Every entry is a web UI or admin API that mediates a privileged side effect — writing a server's own configuration, minting its own administrators, or deciding who may touch which tenant's rows — and each one fails at a different leg of that mediation.

Advisory table¶

The jshERP ladder (one product, nine authz drifts)¶

Why it matters for operators¶

1. Setup/onboarding endpoints are a standing recon question. "Has this product been initialized yet?" is remotely answerable (GET /api/users/onboarding/status was also anonymous here) and, when the finish handler is TOCTOU-raced, is a first-contact admin-creation primitive. Fingerprint version, probe the status endpoint, then fire N parallel finish requests with distinct payloads; multiple 200s + distinct JWTs is the proof. This is the Keycloak flow-restart and CuteNews media-panel precedent generalized: the bootstrap affordance is part of the security model.
2. Generated-config injection is its own class. Octavia's rule: when a control-plane API renders user fields into HAProxy/nginx/systemd/iptables files, (a) fuzz every string field for CR/LF and directive-shaped content, (b) find fields where the validator normalizes (percent-encodes, trims, rewrites) but storage keeps the raw value — that delta is the injection, (c) don't stop after one field: the tls_ciphers sibling shipped alongside the redirect_url fix target unpatched-in-spirit because nobody enumerated the sink's input set.
3. Remote config-set APIs are RCE with a delay. ZLMediaKit's two-endpoint chain (write ffmpeg.snap → invoke getSnap) shows why "it only changes settings" is the wrong severity frame: sweep every set*Config/updateOption/saveSettings route on media servers, proxies, and panel software, and diff which parameters later reach shell, file, or path sinks. Grep the source for parameter consumers, not just the setter's auth check.
4. Session invalidation is a per-transport property. The Airflow logout-revokes-only-_token finding (same day, sibling page) and x-ui's signed-cookie panel are the same audit question asked of each credential transport: after password change / logout / role strip, replay the old credential on every transport (cookie, bearer, API key, gRPC metadata) and record which ones survive. A signed-but-self-contained cookie with no server-side session version can never be revoked by design.
5. Low-role users who can edit config templates control exposure. Any panel field that lands in a generated listen/bind/restart path lets an untrusted role move services onto public interfaces. When enumerating a management panel, diff what each role can change in settings, then restart/reload and re-scan listening sockets from an external vantage.
6. One shared service layer = one authz drift per endpoint, by default. The jshERP cluster is the clearest single-product exemplar of the route-family authz sweep we keep citing: enumerate the CRUD family, then for each verb test (a) privilege to perform the action, (b) ownership of the target object, (c) tenant scope, (d) what the response returns. A generic updateOneValueByKeyIdAndType that dispatches on a caller-supplied type is remote state-dispatch — every accepted type value inherits every missing check.

Replayable validation boundaries (authorized labs / owned instances only)¶

1. Race proof: lab instance reset to pre-onboarding state; fire ≤10 parallel finish requests with distinct synthetic users; record status codes + returned JWTs; delete created users immediately. On production: dispatch/evidence only (status endpoint + 403-vs-200 verdict) — never create accounts.
2. Config-injection proof: private OpenStack lab project only; inject a comment-line marker (# canary) rather than an active directive, then read the rendered HAProxy config from the amphora (approved lab access) to prove the raw byte survived the validator→sink leg. Never inject working directives on a shared proxy.
3. Config-write proof: disposable ZLMediaKit in a container; set ffmpeg.snap to a marker command that writes a temp file, invoke getSnap, observe the file, remove config. Never against reachable streaming infrastructure.
4. Cookie-replay proof: your own lab admin account; capture the session cookie, rotate the password from a second session, replay the old cookie; record survival. Never hold a real user's cookie across rotation.
5. jshERP-class sweep: two lab tenants × two role tiers; canary rows per tenant; for each endpoint run the four-question matrix (privilege/ownership/tenant/response-content). Password-hash disclosure proof stops at "field present, value redacted in report" — never crack or replay real digests.

September 22 follow-up: an /anyone/ route family is a flat-authz confession (lamp-cloud 5-GHSA cluster)¶

• lamp-cloud ≤5.10.0 shipped five authorization-drift GHSAs concentrated on endpoints mounted under the /anyone/ prefix — a naming convention that already telegraphs "identity never checked here": PUT /anyone/baseInfo + PUT /anyone/avatar rewrite any user's profile from caller-supplied target IDs (CVE-2026-94534); getUserInfoById iterates userId to harvest mobile, email, national ID card numbers, WeChat/DingTalk OpenIDs (CVE-2026-94532); FileAnyoneController /anyone/file/down|download serves any attachment, ownership created_by column never consulted (CVE-2026-94533); /anyone/extendNotice/deleteMyNotice deletes other users' notices by ID (CVE-2026-94535); /anyone/visible/resource enumerates any employee's role codes, permission codes, and full front-end router tree via employeeId (CVE-2026-94536).
• Operator rules: (1) route-prefix naming as recon oracle — grep docs/OpenAPI for prefixes like /anyone, /public, /open, /common; controllers under them are the highest-yield authz-drift population, test each with a different user's object IDs. (2) The router-tree/permission-code enumeration (/anyone/visible/resource) is a pre-attack target map: it hands you the role model and the exact front-end routes before you exploit any of them — same value as the jshERP type=UserRole ladder map, and PII harvest (national ID numbers) makes even the read-only legs reportable at high severity. (3) File-download legs that ignore their own created_by column are the classic jshERP by-id CRUD twin — run the four-question matrix (privilege/ownership/tenant/response-content) per endpoint.

September 22 evening follow-up: Virtualizor billing-module handler — a parameter combination is the authentication bypass (3 GHSAs)¶

• Softaculous Virtualizor < 3.2.9 (Patch 9) exposes a billing-module handler on the admin-panel dispatcher reachable by setting act=login plus the presence of the from_billing_module parameter — parameter-presence as the auth skip:
• Unauthenticated root RCE (CVE-2026-43641, GHSA-x23m-fhhv-vj5x, 9.8): the billing_data POST field is unserialize()d and a uid field from the deserialized object flows unmodified into proc_open() via vexec().
• PHP object injection (CVE-2026-43642, GHSA-gjf4-862p-rg96, 8.1): same entry point, unserialize() without allowed_classes restrictions — POP-chain surface independent of the uid leg.
• Unauthenticated balance write (CVE-2026-43643, GHSA-g658-6cgx-fx2p, 7.5): arbitrary uid+balance in billing_data triggers a parameterized UPDATE on users — integrity/availability leg (targeted service suspension) with no injection needed.
• Operator rules: (1) sweep optional "module" parameters for auth-skip semantics — a handler gated on if ($from_x_module) instead of an identity check means the parameter name is the credential; add every from_*, is_*, _internal, debug key you find in source/error strings to the auth-bypass battery, with and without paired parameters. (2) Hosting control panels are multi-tenant crown-jewels: Virtualizor's root RCE owns every managed VPS on the host — same blast-radius framing as the Lantronix serial-console page added today. (3) One entry point, three severities (RCE / POI / blind UPDATE): report each sink leg separately with its own proof, per the multi-leg rule (upload-GET/POST sibling pattern).
• Validation boundary: lab instance only; for the deserialization legs use an inert class-instantiation marker (no POP chains to execution), and for the UPDATE leg use your own disposable tenant row with snapshot/restore. Never touch a real hosting panel's billing tables.

September 23 follow-up: ManageEngine OpManager/NCM five-GHSA ladder — config-generation SSTI, import-path privesc, and device-scope drift¶

• ManageEngine OpManager / NetFlow Analyzer / NCM / Firewall Analyzer shipped five high-severity GHSAs across two version windows (≤12.8.671 and ≤12.8.710): SSTI → RCE in Configlet processing (CVE-2026-12370 / GHSA-rxm6-4vc4-h8j2), unauthorized path traversal in OpManager+NCM (CVE-2026-15358 / GHSA-gjx4-2qj7-4q8h), SQLi in Rule Management Search Reports (CVE-2026-14913 / GHSA-prpv-x87v-q3xv), privilege escalation to Administrator via Report Profile import (CVE-2026-84787 / GHSA-x45x-ww3c-35pv), and low-privilege users creating alert notifications / modifying report schedules for firewalls outside their assigned scope (CVE-2026-84789/84791).
• Durable axes for management-plane audits:
• Config-generation templates are SSTI sinks. Configlets (network-device config snippets) are templated from user-editable fields on an NCM platform — user-controlled template material rendered by a server-side template engine = template injection → RCE on the appliance that holds CLI credentials for every managed switch/firewall. Audit rule: on any network-management/automation platform, every "custom template / config snippet / report template / script field" feature is an SSTI candidate; the sink runs with the appliance's fleet-wide device credentials, so severity = fleet takeover.
• Import features bypass the export-side authz model. Report Profile import reaching Administrator while ordinary paths don't is the import/export asymmetry (this wiki's import-gated/export-open ScadaBR mirror, OpenXML/Report Profile families): sweep import endpoints of any role-relevant object type at the lowest authenticated role.
• "Outside assigned scope" is the appliance tenant check that's missing. Alert-notification and report-schedule writes for devices the requester doesn't manage = the by-id CRUD matrix (jshERP four-question rule) applied to device scope: run every create/modify verb with foreign device/device-group IDs as a low-privilege lab user.
• Validation boundary: lab OpManager instance, synthetic devices/discovered rows, canary template expressions that resolve a marker (not device CLI execution); never push configlets to real gear.

September 23 evening follow-up: ManageEngine Applications Manager six-GHSA ladder — installer-shipped cloud key, low-priv SQL execution, and admin API-key theft¶

• ManageEngine Applications Manager ≤182000/182200 shipped a second ManageEngine management-plane wave (the OpManager ladder above covers the sibling product):
• Google Cloud service-account private key exposed in the product installer (CVE-2026-86708 / GHSA-pwgq-mrvp-r2v7, 10.0, ≤182200): the installer artifact itself carries a vendor GCP SA private key — anyone who downloaded the installer can impersonate the service account against the associated cloud project. New axis for the installer-recon playbook: treat vendor installers/updaters as secrets-bearing artifacts, not just code — unpack every installer you acquire for *.json service-account credentials, embedded keystores, and hardcoded tokens; an unauthenticated attacker never touches the product at all, only its download page. (For authorized research: verify impersonation scope with gcloud auth activate-service-account --key-file + projects.get-class read-only calls against the key's own project only, and report via coordinated disclosure — never mutate the vendor's cloud resources.)
• Low-privileged user runs unauthorized SQL commands → administrator access and RCE (CVE-2026-86677 / GHSA-9pjj-69m8-cffq, 8.8): a "diagnostic/administrative" SQL execution feature trusts the role that requested it, not the command; chained escalation to admin+RCE. The SQL-runner-as-legit-feature is the pattern: any admin panel that offers SQL/JMX/MBean/script execution to some roles needs a privilege gate per invocation, and its presence means every feature-adjacent role field is a privesc target.
• Admin API key disclosure to low-privileged user (CVE-2026-86678 / GHSA-rvc4-j32g-7vv5, 8.8): API-key display/management surfaces leak administrator keys → full admin-level API actions. On every panel with API keys: enumerate the read surfaces (profile pages, config exports, report templates, REST responses) as an auth-low user and diff which key material appears — key read is a finding even without key use flaws.
• Out-of-scope MBean action execution (CVE-2026-86681 / GHSA-4f59-c6wp-7cj6, 7.6), out-of-scope service-monitor deletion (CVE-2026-86679 / GHSA-j25x-qmfq-r547, 7.1), low-priv proxy-settings change (CVE-2026-86683 / GHSA-4jp8-mg92-96wf, 8.1): the same "outside assigned scope" device-scope drift as the OpManager items, plus a proxy-settings write that re-points the appliance's outbound HTTP (SSRF-adjacent pivot: a monitor platform that can reach everything, now behind your proxy — pair with the Sept 21 credential-test-exfil page's exfil-via-proxy-config precedent).
• Durable upgrade to the appliance-audit doctrine on this page: the installer/download channel is a fourth attack surface of a management platform (besides web UI, APIs, and protocol listeners), and built-in "power user" execution features (SQL, MBean, JMX, scripts) are privesc multipliers — enumerate which roles can reach them, then run the four-question matrix per invocation, not per feature.
• Validation boundary: lab instance, disposable low-priv user, synthetic monitors/MBeans; for installer-key findings, no cloud writes and minimal read-only scope confirmation only.

October 2 follow-up: Foreman/Red Hat Satellite provisioning-plane legs + PCP monitoring-plane write API¶

(Red Hat enrichment wave, updated feed 2026-10-02 00:32Z. The page's sibling already carries Foreman safemode self-extension 96658 and Katello fall-through/SQLi 56098/56097 — these are the remaining provisioning-plane legs.)

• Template preview endpoints disclose host root passwords (CVE-2026-96659 / GHSA-2fj2-wwpq-f5jr, critical): Viewer-role users hitting template preview access sensitive data incl. host root passwords; with safemode disabled the same path executes commands as the Foreman system account. Rule: preview/render endpoints of config-generation engines render other tenants' secrets — audit the role map on preview separately from edit/save, and always request a preview of a template you do not own. Same config-generation-template doctrine as the OpManager Configlet SSTI above, this time the sink renders existing secrets without injection.
• Provisioning token checked by DB existence, not request presence (CVE-2026-12423 / GHSA-6m3j-qcjr-3vqm, high): /unattended/provision's valid_host_token? verifies a valid token exists in the DB for a host mid-provision rather than that the request carried it → kickstart template served to callers who send no token at all. Durable inversion: "does the token exist" ≠ "was the token presented" — probe token-gated endpoints with the token omitted, especially while the bootstrap window is live. Kickstart/provision templates are unauthenticated recon gold (provisioning scripts, internal URLs, seeded credentials).
• Overridable job-template metadata is a command-construction input (CVE-2026-12405 / GHSA-9jhx-3c73-g9rh, high): foreman_remote_execution fails to sanitize effective_user when a job template marks it overridable: true; the injection happens during job-execution-environment instantiation on the Satellite server, not in the template body → arbitrary shell as the execution user on every targeted host. Rule: fuzz the meta-parameters around templates (effective_user, timeout, cwd, inventory filters) with shell metacharacters even when the template content is benign — the runner wraps your inputs into its own command line.
• Katello Content View History serves other organizations' lifecycle history (publication/promotion events, associated users, timestamps) by supplied identifier (CVE-2026-79654 / GHSA-xqhp-pxqr-f7m6) — the standard by-id cross-tenant matrix applied to a history endpoint, where tenant scoping is most often forgotten.
• Performance Co-Pilot monitoring stack, same enrichment wave: unauthenticated crafted requests to pmproxy /store overwrite any PMDA metric → arbitrary code execution/system takeover (CVE-2026-16527 / GHSA-cf63-g57m-mc5r, high); network.persocket.filter metric accepts shell metacharacters that execute as the PMDA user when metrics refresh (CVE-2026-16524 / GHSA-f5qw-jg2q-vf56, high) — the ZLMediaKit setServerConfig→getSnap shape again: write-now/execute-later via a metrics store whose values reach shell-backed collectors; unsecured internal linux_sockets connection → root LPE from initial code execution (CVE-2026-16526 / GHSA-534w-2xfq-h655, high); __pmGetPDU() signed integer overflow permanently blinds a daemon's packet reads (CVE-2026-16529 / GHSA-hm96-wjh8-qqgm, DoS, tracked). Recon rule: pmproxy (:44322) and telemetry-store write APIs are first-class targets once discovered — a monitoring host can reach everything, and its ingest path is a delayed execution sink.
• Validation boundary: lab Foreman/Satellite/PCP only; synthetic orgs/users/hosts, marker-file proofs, canary metric values; never read real host root passwords, harvest production provisioning tokens, or write metrics to a monitored production fleet.

October 5 follow-up: Camunda setup-availability predicate computed over the wrong population (CVE-2026-77226)¶

GHSA-mx4r-g275-wg5r / CVE-2026-77226 (critical): Camunda 7.24.0 before 7.24.15 — the Admin webapp's first-run SetupResource decides whether setup is still available by counting only direct members of the camunda-admin group, not all configured administrators. On an instance that is fully administered through any other path (authorizations granted without group membership, alternate admin groups, LDAP-mapped admins), the group is empty, so the bootstrap endpoint stays open: an unauthenticated remote attacker calls the setup user-create endpoint and mints a new administrator — full account takeover, then process deployment with script tasks executing as the engine's service user (the admin→RCE leg the page's own ZLMediaKit ladder already documents).

• Durable rule: "is it initialized?" and "who is an admin?" must be answered from the same population, and they routinely are not. A bootstrap affordance gated on one narrow membership table keeps working forever on instances administered by any alternate mechanism. This is the generalized twin of the nginx-ignition TOCTOU above: there the gate raced; here the gate is permanently mis-evaluated on live production systems.
• Operator probe: on any Camunda/Workflow engine (or any product with a first-run wizard), request the setup-status and setup-user-create routes even when the login page looks fully configured. A 200/error-shape decision table on /api/admin/setup/*-family routes distinguishes "bootstrap closed" from "bootstrap still armed because my admins live elsewhere." Positive proof = create a synthetic admin, verify its auth token, delete it; never deploy real processes.
• Generalizes to every product family with a setup/init/onboarding endpoint: enumerate how availability is computed (which table, which group, which flag), not just whether a check exists.

October 7 follow-up: Foreman restricted-sudo rake tasks as command-injection surface + FlexNet lmadmin hardcoded SOAP auth bypass (Red Hat enrichment, updated feed 2026-10-07 09:33Z)¶

The Red Hat enrichment wave that landed the Oct 2 Foreman legs returned with four new Foreman CLI/rake legs plus a license-management-plane bypass — all management-plane code-execution inputs outside the web app.

• Restricted sudo to foreman-rake is an injection grant, not a read-only grant. Three legs (all published Oct 1, enriched Oct 7): foreman-rake errors:fetch_log passes request_id into a shell-backed grep unquoted (CVE-2026-12540 / GHSA-c5q9-9fc7-jgxp, 8.2 — inject ;, ", |); foreman-rake db:dump / db:import_dump pass the destination/file parameters into a Ruby system() call (CVE-2026-12541 / GHSA-rcq3-9wpf-p347, 8.2 — append commands to the file path); foreman-tail evals user arguments to expand file paths (CVE-2026-12542 / GHSA-79jg-9wx4-f5rr, 5.3). The advisory text itself says the attacker profile is "an attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration)". Durable rule: on any host where sudo -l names a framework CLI/rake runner, every task that takes a path, id, or filename parameter is a command-injection candidate — Ruby system("grep #{x}") and path-to-eval shapes are the two spellings to check per allowed task; argv-safe system(*argv) is the exception, not the default. Sweep: enumerate allowed rake verbs, fuzz each free parameter with ; touch /tmp/marker, "; ", and pipe metacharacters on an authorized host.
• Config parsed through two executable layers at init = boot-time RCE / supply-chain persistence. foreman-rake initialization processes configuration data through two distinct executable layers in /usr/share/foreman/config/settings.rb, giving an SSTI + insecure-deserialization chain reachable from config content (CVE-2026-12544 / GHSA-q8r6-95rf-344m, 7.7, framed by Red Hat as supply-chain risk). Durable axis: anything a config file can say, code runs at next boot — if a lower-privilege role, installer, or API can write any part of a framework's settings file, that's deferred code execution as the service user, surviving app upgrades that don't touch config. Post-exploitation persistence check on any Foreman/Satellite-class host: find config files writable below root, plant an inert marker in the templated/deserialized field, observe execution on restart (lab hosts only; never restart a production provisioning server).
• FlexNet Publisher lmadmin hardcoded authentication bypass in a SOAP handler → unauthenticated privileged admin session (CVE-2026-19572 / GHSA-98jh-cm22-cgp2, critical, vendor: Revenera). License servers are chronically forgotten perimeter assets: lmadmin listens in the 27000–27010 band, is routinely firewall-allowed for vendor license traffic, and its admin console holds full software-inventory data (who runs what, seat counts — recon-grade) plus the license-file write path. Hardcoded-bypass family twin of the Sept 19 insecure=cool rule, server-side this time: when a product ships a magic bypass, every unpatched deployment is permanently unauthenticated on that handler — fingerprint the version band, don't test the bypass against production license servers (a corrupt license file is an availability incident for the whole estate); proof is route-level auth gating plus version banner.
• Validation boundary: authorized Foreman/Satellite hosts only; marker-file proofs for the sudo-injection legs (no data exfil from backup/DB dump tasks); lab lmadmin instance for the bypass shape, version/route evidence on real license servers.

October 7 follow-up (16:1xZ): Homer SIP-capture wave¶

The SIP capture/monitoring server Homer (sipcapture/homer-app) published a three-leg wave fixed June 25 that landed in the GHSA feed Oct 7 16:11–16:13Z — every leg is this page's management-plane-defaults family:

• Empty config value unregisters the auth middleware entirely (GHSA-rqcc-94gv-wjm9 / CVE-2026-62253, critical): both JWTMiddleware() and JWTMiddlewareV4() early-return next(c) when jwtSecret == "", and coordinator.go doesn't even mount the middleware on the /api/v1|v3|v4 protected group when the secret is empty. The Go struct default for coordinator.jwt.secret is "" (the example config ships a placeholder — the struct default is what runs when no config is provided). Result: default install = all protected APIs unauthenticated. Durable rule: "unset optional security config = check skipped" is fail-open by construction — probe any protected route with no Authorization header before you bother attacking the token format; 200-anon on an API that documents JWT is the default-config fingerprint, distinct from a weak-secret finding.
• Bootstrap admin with a source-shipped password and no forced change (GHSA-6xp5-7rcx-xfgx / CVE-2026-62252, critical): EnsureBootstrapAdminUser() inserts admin / sipcapture (SHA-256 constant visible in config.go) at startup with no first-login change flag. Any attacker reaching the login endpoint gets full admin. Rule: grep the source, not the docs — the constant is compiled in, so the default credential pair is banner-grade for every unpatched deployment. Context matters for scoping: Homer stores SIP signaling and call metadata, so unauthenticated admin here is comms-metadata recon, not just an app admin panel.
• Sibling-handler parity on the codebase's own SQL validator (GHSA-f46q-3v67-fmm4 / CVE-2026-62251, high): V4StatisticsQuery passes the user-supplied rawquery verbatim into FlightSQL/DuckDB, while search.go calls sqlvalidator.ValidateRawSQL() on the same class of input. When a product ships its own validator, the audit is mechanical: enumerate every DB call site and diff which ones invoke it — the missed handler is the SQLi. Chained with the empty-secret leg, it's effectively pre-auth SQL on default deployments.
• Same-batch sibling, Foreman ecosystem (GHSA-gfwx-437h-g22q / CVE-2026-107151, medium): smart_proxy_dynflow progress/completion callbacks accept a job report when the one-time token is absent (pull / pull-mqtt remote-exec modes) — a network attacker who knows a running job id can inject fake output and force the recorded success/failure verdict. The guard is if token present: check instead of token required: optional security tokens are absent security tokens. Sweep async callback receivers (job results, webhooks, status reporters) for the missing-then-permit branch; proof = lab job, synthetic output canary, forged terminal status.

October 7 (18:32Z) follow-up: Gophish five-leg wave — the phishing framework itself as a red-team supply-chain target¶

Gophish through 0.12.1 (the standard operator phishing platform, self-hosted by red teams and SOC-simulation teams) published five advisories in the 18:32Z window. This one matters differently: the audience of the page is the tool's own user base — a Gophish instance is a credential-dense red-team implant (SMTP profiles with live creds, recipient PII lists, campaign templates, API keys).

• Cross-user object takeover on every campaign artifact (GHSA-5h35-6pm3-mw32 / CVE-2026-107270, 7.1): sequential-id IDOR on POST /api/groups|templates|pages|smtp/ — any authenticated user overwrites/reassigns another user's groups, templates, landing pages, sending profiles, locking owners out and exposing victim recipient lists. Classic sequential-object axis, but note the sink set: the sending profile object carries SMTP credentials, so this is a cred-read + mail-relay-hijack primitive, not just data tampering.
• SSRF via site import, deny-list default dialer (GHSA-5724-58m3-c7r6 / CVE-2026-107273, 4.3): POST /api/import/site fetches attacker URLs; the default Go dialer deny list doesn't block loopback/private → read internal services, enumerate internal hosts/ports through error-message reflection. Low-priv to internal-pivot; the reusable note is the deny-list-vs-allowlist dialer distinction plus error-text as port-scanning oracle.
• Login rate-limit bypass by spoofing X-Forwarded-For/X-Real-IP (GHSA-hxwc-4ggw-27w5 / CVE-2026-107271, 5.3): limiter keyed on rewritten RemoteAddr, so a different forwarded address per request never trips it — unlimited password guessing. Same rule as the Sept 18 Heimdall forwarding-header family: if the limiter reads the same header the attacker controls, it's decoration. Prove by firing N failed logins with N distinct XFF values and observing no lockout/throttle delta.
• Username enumeration via bcrypt timing on /login (GHSA-7g89-3w9x-xw88 / CVE-2026-107269, 3.7): existing accounts take measurable bcrypt-comparison time; nonexistent usernames short-circuit. Standing timing-oracle class; the operator note is pairing it with the XFF leg above — enumerate then unthrottled-crack is a complete credential-attack chain on one admin panel.
• Stored XSS through SMTP server error messages → admin-session API-key theft (GHSA-2424-98jr-qcjq / CVE-2026-107272, 4.7): error text returned by the (attacker-controlled or intercepted) SMTP server for a sending profile is rendered unsanitized when administrators view campaign results/test sends. Durable axis: protocol error strings from external servers are attacker-controlled input that lands in the operator's browser. Audit every admin UI that displays third-party protocol responses (SMTP/IMAP/LDAP/OAuth error bodies, webhook failure text) as a stored-XSS sink family — the injection never passes through a user-facing form.

Operator implications for engagements running Gophish infrastructure: patch to >0.12.1, bind the admin UI behind auth/IP allowlist, run the operator user least-privilege (any authenticated user = cred read pre-patch), and treat third-party SMTP relay responses as hostile input. For engagements against an org running Gophish: it's an unsegmented internal web app with sequential IDs, an SSRF importer, and header-keyed rate limiting — the standard sweep finds all five in minutes.

October 11 follow-up: a security aspect that only runs when the credential is present — omit the header, get admin (Wukong_HRM, CordysCRM wave)¶

Oct 11 03:30Z wave on two Chinese HR/CRM stacks extends this page's "optional security tokens are absent security tokens" rule (Foreman dynflow, line above) to its logical endpoint:

• Wukong_HRM critical auth bypass (GHSA-8w9v-279h-hchp / CVE-2026-108707): the ParamAspect auth interceptor only performs token validation when the AUTH-TOKEN header is present; omitting the header entirely skips the aspect and lands you in HR-admin context — read payslips/salary history company-wide, download attachments, modify or delete HR records. The null-then-permit branch is the same shape as the Foreman missing-token callback and the Pando/JWT empty-secret legs on this page, but the payoff class is different: an AOP/interceptor whose pointcut matches "header exists" instead of "endpoint requires auth" is an unauthenticated admin door on every annotated endpoint at once. Sweep: on any Spring/AOP app, send each protected request with the auth header absent (not empty, not garbage — absent) and diff against empty-value and invalid-value responses; "absent = 200, empty = 401" fingerprints present-gated interceptors.
• Same product's sibling defect: GHSA-j95x-qfc5-mfv5 / CVE-2026-108708 — EmployeeAspect assigns every caller the HR-admin role and the data-scope helper returns all employees. When the aspect-layer is the role system, grep aspect classes for unconditional role stamping; an aspect bug is never one endpoint, it is the whole annotated surface.
• CordysCRM seven-leg missing-annotation wave (CVE-2026-108692–108706, fixed 1.9.2+): eight /field/source data-source endpoints page org-wide leads/contracts/invoices without permission annotations; /field/source/business-title leaks invoicing entities with tax IDs and bank account numbers; POST /approval-flow/webhook/test is an any-authenticated SSRF whose SSRFValidator is defeated by a redirect from a controlled host (creation-time validation, connect-time redirect — July 28 URL-policy page's standing rule); POST /contract/sort has no annotation and modifies any contract including other organizations'; and the sharpest generic leg: setting owner to your own user id skips the permission check on follow-record endpoints — self-assignment-as-authorization on an object you don't own. Probe: on any ownership-gated write, try claiming ownership in the same request that mutates. SQL-operator-precedence twins in mall4j (GHSA-8r5r-2mmr-2vjr / GHSA-m4x2-mf8c-9rmw): AND/OR mixing in cart queries = cross-user read + cross-user delete from one unparenthesized WHERE — the recurring hand-written-SQL class.

Proving boundaries: own lab installs, synthetic employee/contract rows, owned redirect host for the SSRF validator check; never touch real HR/payslip or invoicing data.

October 12 follow-up: Kong Gateway hybrid-mode clustering RPC SQLi — the mTLS peer channel is an unvalidated input surface (CVE-2026-1907 / GHSA-gjvg-7rjg-jm9f, high)¶

Kong Gateway (Enterprise + OSS) hybrid mode: the Data Plane→Control Plane clustering RPC logic interpolates RPC request fields into SQL — crafted RPC requests to the CP clustering port yield unauthorized database access. Gating is (a) network reachability of the clustering port and (b) a valid client certificate/key. Operator axes:

1. A mutual-TLS peer identity buys trust in the whole protocol — every field an RPC handler reads deserves parser fuzzing as if it were user input. The cert boundary selects who may speak; it says nothing about what may be said. On any clustered appliance/service with an internal RPC/replication port gated only by mTLS (Kong CP, DB replicas, K8s kubelet-style channels), the post-cert grammar is the attack surface, and a stolen/leaked dataplane cert turns the "trusted" control plane's database into a query target. Recon: clustering ports are fingerprintable (Kong's is a distinct listener from the proxy/admin ports); enumerate feature-named ports on any cluster product before enumerating credentials.
2. Fingerprint for grep: RPC dispatchers that concatenate message fields into SQL/commands, contrasted with handlers using bound parameters — same internal-deputy lineage as the OpenFGA/TargetAllocator legs. Proof boundary: lab CP + disposable generated client certs, synthetic RPC payloads, never a live control plane.

October 12 21:3xZ follow-up: HAProxy Data Plane API — configuring TLS on one listener silently disables authentication on all of them (CVE-2026-109575 / GHSA-7jqw-rhp8-c8vf, 9.8 critical, fixed 3.4.4/3.3.9/3.2.17/3.0.25/2.9.29 + EE backports)¶

The load balancer's own management API is the entry point. Server.ConfigureAPI() applies process-global authentication logic: when an operator configures a TLS CA (tls_ca) plus a numeric tls_port, the code globally disables Basic auth on the shared internal request handler. That handler is concurrently shared by the HTTP, HTTPS, and UNIX-domain-socket listeners, and mTLS client-certificate verification (tls.RequireAndVerifyClientCert) is enforced only on the HTTPS server path. Result: every simultaneously active non-mTLS listener — the plain HTTP management port and the local UDS — fails open to full unauthenticated admin API access: read the entire managed config in cleartext (backend IPs, health checks, ACLs, auth headers baked into server config) or replace the whole configuration via the raw-config endpoint. The fix migrates to per-request TLS connection-state validation, which is the shape the control should always have had.

Operator axes (extends this page's "security aspect that only runs when the credential is present" leg directly above):

1. A hardening action on one listener can be a global auth kill-switch — probe transports after mimicking a secured deployment. The trigger is operator hardening (adding mTLS to the TLS listener), so a more secured-looking deployment is the vulnerable one. Recon decision table on any Data-Plane-API-shaped service (default ports 5556 HTTP / 5555+TLS / /var/run/haproxy.sock): send the same admin request (GET /v2.4/configurations, /version, /stats) over HTTP-over-TCP, HTTP-over-UDS, and HTTPS with no client cert, and compare. 200-on-HTTP-with-401-only-on-mTLS = this finding. Sweep the same shape into every multi-transport admin plane (HTTP+UDS+named-pipe servers sharing a router): auth flags set during configuration code, keyed on one listener's settings, are process-global until proven per-request.
2. Grep fingerprint (white-box): an auth-disable assignment at server-construction time (if cfg.TLS != nil && cfg.TLS.Port > 0 { handler.authDisabled = true } shape) rather than a check inside the request path = the whole class. Correct implementations branch on r.TLS per request; test by hitting the same handler over TLS and non-TLS with identical credentials and diffing the verdict.
3. Config-read is the crown jewel on load balancers. The Data Plane API config endpoint is a config-as-secrets oracle: HAProxy configs routinely embed backend auth headers, secret/password values in health-check URLs, and internal topology. On authorized engagements, an unauthenticated dataplane-API read is a full topology + credential-material finding by itself, and config replace means you own the traffic path (redirect, inject, split) for everything behind it — report the read and the write as separate severities on the same gate.
4. Version-fingerprint before claiming: fixed bands are precise (3.4.4/3.3.9/3.2.17/3.0.25/2.9.29); GET /version is itself unauthenticated, so the exact band is readable pre-auth — same "the product tells you it's vulnerable" pattern as the Octopus/FlexNet legs on this page.

Validation boundary: lab HAProxy with your own config; prove the fail-open with an inert config read + a canary frontend swap in a disposable config, never against shared or production load balancers.

Tracked from the same wave without publication¶

• Proxmox PMG apt-get changelog argument injection (CVE-2026-94588, CSRF-style, thin detail) — argument-injection class already covered by the command-wrapper page; revisit if an argv-level PoC lands.
• nginx-ignition ParseAcceptLanguage _-separator CPU amplification (CVE-2026-61629) — DoS-only, but noted: the upstream CVE-2022-32149 guard capped - not _ even though the scanner aliases them — sibling of the "fix covered one spelling not its alias" family (Grav tokenizer, Netty RtspMethods).
• FalkorDB Redis-module memory-safety six-pack (CVE-2026-88406–88412) — parser/DoS class per precedent.
• Univer UniscriptExecutionService / RemoteRegisterFunctionService RCE pair (CVE-2026-88404/88405) — sparse detail, no reachable-sink specifics; revisit when detail lands.
• nocobase checkSQL SQLi + serverRequest SSRF (CVE-2026-88402/88403) — classes already covered (ClickHouse filter-key, generic SSRF); no new axis.
• Stencil core scoped-slot textContent-parsed-as-HTML DOM XSS (CVE-2026-79320) — framework render bug class, adjacent to hydration/clobbering family, tracked.
• Dell Command local LPE/info-disclosure singles, Moore Threads + ColorFul iGameCenter IOCTL drivers, libstoragemgmt/sg3_utils SCSI VPD overflow, web2py admin webservices traversal, EMLOG-Pro/idccms/CRMEB sparse singles — local/driver/sparse classes, tracked.
• k8saudit init/ephemeral-container rule-blindness (GHSA-jhjp-4c2q-xmx4) — detection-evasion note worth remembering (privileged pod via initContainers slips shipped rules) but it is audit-rule content, not an exploit path; tracked.

Related pages: the Sept 21 auth-method precedence page (Airflow replay-after-logout twin), the Sept 21 CuteNews page (media-panel login-to-RCE ladder), the June 11 Keycloak page (flow-state/bootstrap affordances clearing security state), the Aug 5 command-wrapper page (Proxmox argument-injection sibling), and the Sept 19 alternate-surface page (route-family authz sweep precedent).