winfunc

Finding six NGINX vulnerabilities with open models

Mufeed VH — Thu, 23 Jul 2026 00:00:00 GMT

We used GLM-5.1 and GLM-5.2 to scan NGINX. The scan produced six security findings with five CVE identifiers. This report describes the affected code, analysis traces, and proof conditions.

Hacking the old HackerNews codebase

Mufeed VH — Sat, 18 Apr 2026 00:00:00 GMT

Auditing the old HackerNews codebase for security vulnerabilities with LLMs on a specialized harness.

What an automated vulnerability research system actually found

Mufeed VH — Thu, 26 Mar 2026 00:00:00 GMT

Thirteen patched bugs across nine projects, including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth. What the system got right, where it still falls over, and why executable PoCs matter more than model reasoning.

How Asterisk Works

Mufeed VH — Fri, 30 Aug 2024 00:00:00 GMT

A repost of the original Asterisk architecture: how an AI security agent indexed code, generated attack ideas, verified vulnerabilities, and produced patches with low-noise reports.

How Do I Enhance Cloud Security With AI? A Practical Overview

Winfunc Team — Thu, 07 May 2026 00:00:00 GMT

How do I enhance cloud security with AI? Learn where AI improves cloud security, where it creates risk, and how to build a practical AI cloud security roadmap.

How to Choose an AI SAST Platform With Low False Positives

Winfunc Team — Wed, 29 Apr 2026 00:00:00 GMT

Learn how to compare AI-powered SAST and AppSec platforms using reachability, code context, auditable triage, exploitability validation, and false-negative safeguards — not self-reported false-positive rates.

SAST vs DAST: What's the Difference and When Should You Use Each?

Winfunc Team — Tue, 28 Apr 2026 00:00:00 GMT

SAST vs DAST explained: compare static and dynamic application security testing, see examples, pros and cons, CI/CD guidance, and a 2026 AppSec workflow.

AI Vulnerability Triage: A Practical Guide for AppSec Teams

Winfunc Team — Tue, 28 Apr 2026 00:00:00 GMT

AI vulnerability triage helps AppSec teams validate findings, prove exploitability, prioritize risk, and route fixes. Learn what it can automate, where it fails, and how to evaluate it.

Stream complex-value capture desynchronization causes heap overflow (CVE-2026-42533)

Winfunc Research — Wed, 15 Jul 2026 00:00:00 GMT

`ngx_stream_complex_value()` calculated an output length and copied the output in separate passes over mutable session-wide regex capture state. In a stream expression such as `return "$1$m"`, the first pass initially counted `$1` as zero bytes. Evaluating the later `$m` variable ran a regex-backed `map` over attacker-controlled TLS SNI and populated the session's capture array. The copy pass then revisited `$1`, found the new capture, and copied the SNI hostname into the buffer allocated from t...

seroval.fromJSON() Promise resolver type confusion invokes attacker-controlled methods (CVE-2026-59940)

Winfunc Research — Wed, 08 Jul 2026 00:00:00 GMT

A type confusion issue in `seroval.fromJSON()` allowed attacker-controlled JSON input to cause `PromiseSuccess` and `PromiseFailure` nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In vanilla `fromJSON()` mode, the serialized node tree and top-level `m` marked-reference list can place an attacker-created object in that table. The vulnerable handlers retrieved `refs[node.i]` and c...

gRPC forwarded headers can overflow the upstream HPACK request buffer (CVE-2026-42055)

Winfunc Research — Wed, 17 Jun 2026 00:00:00 GMT

When an HTTP/1.x request reaches a `grpc_pass` location, NGINX forwards client request headers by default. Before the fix, `ngx_http_grpc_create_request()` sized each forwarded header name and value with the fixed `NGX_HTTP_V2_INT_OCTETS` allowance of four HPACK integer bytes, then later serialized the same strings through the variable-length HPACK encoder. If `ignore_invalid_headers off` allowed invalid raw-unfriendly header names to be retained, and `large_client_header_buffers` allowed multi...

HTTP/2 upstream proxy request encoder permits heap overflow with oversized raw headers (CVE-2026-42055)

Winfunc Research — Wed, 17 Jun 2026 00:00:00 GMT

When `proxy_http_version 2` sends a request to an HTTP/2 upstream, `ngx_http_proxy_v2_create_request()` builds an HPACK-compressed request header block. Before the fix, the sizing pass used the same four-byte `NGX_HTTP_V2_INT_OCTETS` allowance for every forwarded header name and value length, but the serialization pass used the variable HPACK integer encoder. A request with raw-encoded forwarded header names and values longer than `NGX_HTTP_V2_MAX_FIELD` makes the actual HPACK length prefix lar...

rewrite overlapping captures heap overflow (CVE-2026-9256)

Winfunc Research — Fri, 22 May 2026 00:00:00 GMT

A regex rewrite such as `rewrite ^/((.*))$ http://127.0.0.1:18081/$1$2 redirect;` can make `$1` and `$2` cover the same attacker-controlled URI bytes. In NGINX 1.31.0 (`e8053c867f9ab14f323e3019ccab585d857abb66`), the rewrite compiler could discard the capture-aware length bytecode for capture-only replacements because `sc.variables == 0` and `sc.dup_capture == 0` when the replacement references distinct capture numbers. At runtime, `ngx_http_script_regex_start_code()` then used its `code->lengt...

HTTP/2 upstream frame injection via oversized proxy_set_body (CVE-2026-42926)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

When `proxy_http_version 2` selected the HTTP/2 upstream proxy path and `proxy_set_body` generated a custom request body, `ngx_http_proxy_v2_create_request()` appended that body directly after a single DATA frame header in the initial upstream buffer. HTTP/2 frame lengths are 24-bit values. The vulnerable code stored `body_len` into `length_0`, `length_1`, and `length_2` without checking or fragmenting bodies larger than 16,777,215 bytes. If `proxy_set_body` produced a body over that limit, the...

stream accepts revoked client certificates despite ssl_ocsp on (CVE-2026-28755)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

When a `stream` listener is configured with both `ssl_verify_client on` and `ssl_ocsp on`, nginx performs the OCSP request and learns that the presented client certificate is revoked, but it still completes the TLS handshake and allows the session to reach application data. The root cause is a logic gap specific to `stream`: the OCSP helper records revocation state, but the `stream` verification path in `ngx_stream_ssl_handler()` checks only `SSL_get_verify_result()` and whether a certificate i...

SCGI unbuffered mode sent truncated CONTENT_LENGTH causing backend desync

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

In the SCGI module, `ngx_http_scgi_create_request()` historically derived `CONTENT_LENGTH` by summing the currently buffered request-body chain (`r->upstream->request_bufs`). This behavior was introduced to support chunked-body accounting, but it becomes inaccurate when `scgi_request_buffering off` is used and the body is still streaming. With unbuffered request forwarding, only an early body prefix may be available when SCGI headers are serialized. The emitted SCGI netstring can therefore adve...

WebDAV COPY/MOVE path overlap corrupts files and collections

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The NGINX HTTP DAV module's `ngx_http_dav_copy_move_handler()` parsed the client-controlled `Destination` header and mapped both the request URI and destination URI to filesystem paths, but it did not validate that the resolved paths were distinct and non-overlapping. If a `COPY` request targeted the same file path as its source, execution reached `ngx_copy_file(path.data, copy.path.data, &cf)`. `ngx_copy_file()` opens the source first, then opens the destination with `NGX_FILE_TRUNCATE`; when ...

RSC reply decoder DoS via $K FormData amplification (CVE-2026-23864)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The server-side React Flight reply decoder treats `$K` tokens as **nested FormData** and reconstructs them by scanning the backing request form and copying entries into a new `FormData`. Because the decoder performs a full scan and allocation **for every `$K` occurrence** with no global limits, an attacker can embed thousands of `$K` tokens in a small multipart payload and force the server to allocate tens of MB of heap while decoding. This creates a high-amplification DoS that is remotely r...

Permission model bypass via unchecked Unix Domain Socket connections (CVE-2026-21636)

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

Node.js permission model **fails to enforce network restrictions for Unix Domain Socket (UDS) connections**. With `--permission` enabled and **without** `--allow-net` (or any allowlists), an attacker-controlled URL or `socketPath` still reaches arbitrary local sockets via `net`, `tls`, or `undici`/`fetch`. This breaks the security boundary the permission model is meant to provide and enables SSRF-to-local-RCE style impact against local daemons (e.g., Docker API) while the administrator believes ...

Authentication bypass on FastMCP custom routes

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

`FastMCP.custom_route()` allows developers to mount arbitrary HTTP handlers intended for sensitive use cases such as OAuth callbacks or admin APIs, but it never applies `RequireAuthMiddleware` even when the server is configured with a token verifier. Only the built-in SSE and StreamableHTTP endpoints are wrapped; custom routes are appended to the Starlette app as-is while Starlette’s `AuthenticationMiddleware` merely records credentials without rejecting unauthenticated requests. As a result any...

SQL Injection via queueName in getDatabaseQueuesMetrics

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

`getDatabaseQueuesMetrics` builds SQL statements with `queueName` interpolated directly into table identifiers and literals. The `queueName` value originates from the route parameter (`/integrations/queues/queues/:queueName`) which is attacker-controllable. No validation or quoting is applied before the SQL is sent to `executeSql`, allowing crafted queue names to break out of the identifier context and execute arbitrary SQL statements against the project database....

Exponential merge keys in Bun's YAML implementation leads to DoS

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

`Bun.YAML.parse` materialises YAML mappings by iterating every merge (`<<`) entry and blindly appending the referenced property list to the target object (`src/bun.js/api/YAMLObject.zig:1034-1045`). Because the loop does not track merge depth or repeated anchors, an attacker can craft a document where each level merges all previous anchors (`<<: [*a0, *a1, …]`). The parser repeatedly copies the entire accumulated property array for each level, resulting in exponential work while the payload rema...

0-click Account Takeover and Admin Operations via helper endpoint authorization bypass

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

The helper endpoint responsible for updating user email addresses performs a sensitive account mutation without performing any authentication or authorization beyond confirming that an `Authorization` header exists. `Api::Internal::Helper::BaseController#verify_authorization_header!` only checks for the header’s presence and does not enforce a signature, token, or identity check unless an action explicitly invokes `authorize_hmac_signature!` or `authorize_helper_token!`. The `UsersController` ne...

Remote cluster PATCH response leaked authentication tokens (CVE-2026-7184)

Winfunc Research — Mon, 18 May 2026 00:00:00 GMT

Mattermost's remote-cluster API already treated `token` and `remote_token` as sensitive fields: list, create, accept, and get handlers called `RemoteCluster.Sanitize()` before serializing objects to clients. The PATCH handler was the missed trust boundary. After decoding a caller-controlled `RemoteClusterPatch` and applying it through `App.PatchRemoteCluster`, `patchRemoteCluster()` wrote `updatedRC` directly to the HTTP response without sanitizing it first. The public advisory [MMSA-2026-00662...

Group syncable scheme_admin authorization bypass (CVE-2026-7387)

Winfunc Research — Wed, 13 May 2026 00:00:00 GMT

Mattermost group syncables let LDAP groups be linked to teams or channels and can optionally mark synchronized group members as scheme admins. Before the fix, `linkGroupSyncable()` and `patchGroupSyncable()` decoded `scheme_admin` as ordinary patch data, checked only the permissions needed to link or patch the group syncable, and then persisted the flag. The background sync path later trusted that stored bit and updated team or channel member role state. The public advisory [MMSA-2026-00665](ht...

mmctl terminal escape injection via unsanitized server-controlled output (CVE-2026-3108)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

Mattermost's `mmctl` plain-text output path accumulated values from API responses and templates in `printer.Lines`, then wrote each line directly to stdout in `Printer.linesToBytes`. The report-posts command also bypassed the printer and wrote `post.Message` directly with `fmt.Fprintf(os.Stdout, ...)`. Because post messages and many other displayed fields can be controlled by ordinary users on the server being administered, a malicious value containing ANSI CSI sequences or OSC sequences could b...

Zip bomb memory exhaustion in recursive document extraction (CVE-2026-3114)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

Mattermost enforces `FileSettings.MaxFileSize` on uploaded files, but the document extraction service previously did not apply that same limit to each decompressed archive entry. When file-content extraction and archive recursion were enabled, `archiveExtractor.Extract` mounted an uploaded archive, walked entries with `fs.WalkDir`, opened each entry, and called `io.ReadAll(file)` before handing the decompressed bytes to sub-extractors. A small compressed archive could therefore expand into very ...

Group member IDs leaked because GetGroup bypassed view restrictions (CVE-2026-3115)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The `GET /api/v4/groups/{group_id}` handler computed `ViewUsersRestrictions` for the session user and passed those restrictions into `App.GetGroup`. `GetGroup` correctly applied restrictions when returning `IncludeMemberCount`, but when `IncludeMemberIDs` was requested it called `Store().Group().GetMemberUsers(id)`, a raw unpaginated store method with no restrictions parameter. Guests or restricted users could therefore request a group with `include_member_ids=true` and receive member user IDs o...

mmctl export downloads created world-readable local files (CVE-2026-3113)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

`mmctl export download` and related export download flows write potentially sensitive export archives to the administrator's local filesystem. The shared `downloadFile` helper used `os.Create(path)` when the destination did not exist, which creates files with mode `0666` before process umask is applied. On a common `022` umask, the resulting export file is `0644` and readable by other local users. When the destination already existed but was empty, `os.OpenFile(path, os.O_WRONLY, 0600)` did not ...

Private channel enumeration through /mute error messages (CVE-2026-21386)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The `/mute` slash command accepts an optional channel handle, strips the leading `~`, and looks up the named channel with `Store().Channel().GetByName(channel.TeamId, channelName, true)`. That lookup can resolve a private channel by name even when the caller is not a member. If the channel does not exist, the handler returns `api.command_mute.error`; if it exists but `ToggleMuteChannel` fails because the caller is not a member, the handler returned `api.command_mute.not_member.error`. Those two ...

Oversized password login DoS in legacy password comparison (CVE-2026-24458)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

Mattermost validates password length when passwords are created or changed, but affected login comparison paths did not consistently apply the same maximum-length guard before invoking password verification. In modern 11.x branches, `App.checkUserPassword` parses the stored hash and dispatches to the matching hasher. PBKDF2 already enforced `PasswordMaxLengthBytes`, but the legacy bcrypt hasher's `CompareHashAndPassword` did not check input length before calling `bcrypt.CompareHashAndPassword`. ...

User-Agent version parser panic during session creation (CVE-2026-25783)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

`DoLogin` parses the HTTP `User-Agent` header while creating a session and stores platform, OS, browser name, and browser version on the session. The version helper looked for Mattermost-specific prefixes such as `Mattermost Mobile/`, `Mattermost/`, `mmctl/`, and `Franz/`, then immediately returned `strings.Fields(afterVersion)[0]`. If the header ended at the prefix or contained only whitespace after it, `strings.Fields` returned an empty slice and the `[0]` index panicked. This is not reached ...

SSRF protection bypass via IPv4-mapped IPv6 literals (CVE-2026-2455)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

Mattermost's shared HTTP service protects untrusted outbound requests by resolving the target host and passing each IP through `allowIP`, which calls `IsReservedIP` and `IsOwnIP`. `IsReservedIP` contained IPv4 private, loopback, and link-local CIDRs, but it compared the raw `net.IP` value directly against those ranges. For an address such as `::ffff:127.0.0.1`, Go represents the value as an IPv4-mapped IPv6 address. Without canonicalization, the intended IPv4 reserved ranges could be bypassed an...

Multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

The `multiSession` plugin's `/sign-out` after-hook (`packages/better-auth/src/plugins/multi-session/index.ts`) blindly trusts every cookie whose name matches the `_multi-` pattern. The handler splits the first segment of each raw cookie value and forwards the resulting strings to `ctx.context.internalAdapter.deleteSessions(...)` without ever calling `ctx.getSignedCookie` or verifying an HMAC. Because the Cookie header is entirely attacker-controlled, any authenticated user who learns another ac...

HTTP/1.1 CL.TE request smuggling in actix-http (GHSA-xhj4-vrgc-hr34)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The HTTP/1.1 request parser in `actix-http` accepted requests containing both `Content-Length` and `Transfer-Encoding: chunked`. During header conversion, `MessageType::set_headers` recorded the content length and also marked the message as chunked. The payload selection logic then preferred the chunked decoder whenever `chunked` was true, instead of rejecting the conflicting framing. In a CL.TE deployment, an upstream proxy can frame the request using `Content-Length` while forwarding the ambi...

Hoppscotch CLI sandbox escape through Node vm pre-request scripts (CVE-2024-34347)

Winfunc Research — Mon, 01 Jan 2024 00:00:00 GMT

Hoppscotch CLI executes collection-supplied pre-request and test scripts while running `hopp test`. Unlike the web and desktop clients, the CLI could not rely on browser Web Workers and used the Node.js `vm` module through `@hoppscotch/js-sandbox`. The sandbox created a `vm` context, then injected host-created objects such as `pw`, `atob`, and `btoa` into that context before calling `runInContext` on attacker-controlled collection script text. Node's `vm` module is not a security boundary for u...

Regex room-claim case mutation permits unauthorized protected-meeting access

Winfunc Research — Thu, 10 Sep 2026 00:00:00 GMT

A participant with a legitimate regex-scoped JWT could join a protected room that the issuer's signed pattern did not authorize. A claim such as `^team-%D+$` was transformed into `^team-%d+$`, turning a non-digit policy into a digit policy before the MUC join check. **Root cause.** `Util:verify_room()` lowercased the room claim before deciding whether it was a literal room or a Lua pattern. Case conversion is safe for a canonical room identifier, but it mutates pattern operators such as `%D`, `...

Demoted participants retain moderator recording and dial-out permissions

Winfunc Research — Wed, 09 Sep 2026 00:00:00 GMT

A token-authenticated participant whose JWT disabled recording, livestreaming, transcription, and outbound calls could retain those capabilities after a legitimate moderator temporarily promoted and then demoted them. **Root cause.** `process_set_affiliation()` copied the granting moderator's `jitsi_meet_context_features` table into the promoted participant's session. The demotion branch cleared the table only for sessions without `auth_token`, so token-authenticated sessions retained stale gra...

Read-only users can cancel modification queries across users and databases

Winfunc Research — Wed, 09 Sep 2026 00:00:00 GMT

An ordinary authenticated user with read access to one database could invoke the special transaction abort endpoint and terminate other users' active modification queries across unrelated databases. **Root cause.** `RestTransactionHandler::executeAbort()` exposed the `/write` suffix after only the common database-read check. `Manager::abortAllManagedWriteTrx()` then iterated every database and killed each modification query without checking `Query::user()` against the authenticated caller. **R...

MCP client setup exposes Fly API tokens to other local users

Winfunc Research — Tue, 08 Sep 2026 00:00:00 GMT

The stream/SSE MCP setup command placed the user's reusable Fly API token in a client configuration argument list. On a normal Unix `umask 022`, the config could be created or replaced as mode `0644`, allowing another local account to read the credential. **Root cause.** `runServer()` appended `--bearer-token` to the persisted MCP proxy arguments and `UpdateConfig()` used ordinary file creation/rename semantics without enforcing an owner-only mode on the final file. **Remediation evidence.** F...

Shop JWT identifier collision enables admin API takeover

Winfunc Research — Wed, 02 Sep 2026 00:00:00 GMT

An ordinary customer could change their shop email to collide with an API administrator's identifier, obtain a normal shop JWT, and replay it to the admin API. The admin firewall reloaded the identifier through the administrator repository and granted the victim administrator's API role. **Root cause.** The shop and admin API firewalls trusted the same Lexik JWT signing configuration, while the token lacked a firewall audience or principal-class claim. A writable customer email became the shop ...

Administrator password-reset link poisoning enables account takeover

Winfunc Research — Wed, 02 Sep 2026 00:00:00 GMT

An unauthenticated attacker could request an administrator password reset with an attacker-controlled Host header. The legitimate email then contained the real reset token under the attacker's HTTPS origin, allowing token capture when the administrator clicked it. **Root cause.** Reset token generation and email rendering happened synchronously inside the initiating request. Twig's absolute `url()` helper used the request-derived router context, while the application supplied neither a strict t...

Captured payment can be reused after cart total inflation

Winfunc Research — Wed, 02 Sep 2026 00:00:00 GMT

A guest could capture a legitimate low amount, enlarge the same mutable order, and have Sylius mark the enlarged order paid while the payment provider had captured only the original amount. **Root cause.** `OrderPaymentProcessor` rewrote the amount and currency of the last cart-state payment whenever the order total changed, even after a capture or authorization request had handed that payment to a gateway. The later status flow trusted the gateway's success state but did not reconcile the capt...

Channel-scoped administrators can read the global administrator directory

Winfunc Research — Wed, 02 Sep 2026 00:00:00 GMT

An administrator limited to one Vendure channel could list and retrieve administrators assigned exclusively to other channels, exposing staff names, email identifiers, role codes, permissions, and the global authorization structure. **Root cause.** The GraphQL resolvers required `ReadAdministrator` only for the active request channel. `AdministratorService.findAll()` and `findOne()` then queried the global Administrator table without intersecting target roles and channels with the active user's...

Workload API tokens can be exchanged for persistent unscoped user tokens

Winfunc Research — Fri, 28 Aug 2026 00:00:00 GMT

Code running inside a ZenML pipeline workload could exchange its run-bound token for a generic user token that remained valid after the workload ended, preserving the issuing principal's control-plane RBAC authority for up to the generic-token lifetime. **Root cause.** The `api_token()` generic branch returned before the confinement logic used for workload-token issuance. It called `generate_access_token()` with only `user_id` and `expires_in`, silently dropping `schedule_id`, `pipeline_run_id`...

Unauthenticated Serve replica gRPC requests allow arbitrary code execution

Winfunc Research — Wed, 05 Aug 2026 00:00:00 GMT

A network caller could invoke an internal Serve replica gRPC method without the configured Ray token and place a Python pickle reduction in `pickled_request_metadata`, causing arbitrary code execution in the replica process before normal request dispatch. **Root cause.** `Replica.__init__` created `ASGIService` with raw `grpc.aio.server()` and `_on_initialized` bound it through `add_insecure_port("[::]:0")`. The shared token interceptor and TLS helper were skipped, while `_wrap_grpc_call` perfo...

Feedback Records gateway accepts organization permissions across tenants

Winfunc Research — Thu, 30 Jul 2026 00:00:00 GMT

A holder of an API key for organization A could select an active feedback directory belonging to organization B and list, search, create, update, or delete its feedback records according to A's organization-level permissions. **Root cause.** The gateway resolved the target directory's authoritative `organizationId`, but the API-key branch called `hasApiKeyImplicitFeedbackDirectoryAccess()` without passing or comparing it. A's `organizationAccess.accessControl` flags were therefore treated as gl...

Data-app SDK bridge can disclose warehouse data from other projects

Winfunc Research — Thu, 30 Jul 2026 00:00:00 GMT

A project-A data-app author could make their sandboxed app request project-B metric queries through a victim viewer's authenticated parent page. If the viewer could access both projects, the bridge returned project-B warehouse rows to attacker-authored iframe code. **Root cause.** `useAppSdkBridge()` accepted `lightdash:sdk:fetch` messages and matched generic `/api/v2/projects/[^/]+/...` route patterns, but never compared the path's project segment with the trusted `projectUuid` of the displaye...

Presto and Trino filter interpolation bypasses row-level security

Winfunc Research — Mon, 27 Jul 2026 00:00:00 GMT

An ordinary authenticated analytics user could inject Presto/Trino syntax through a semantic string filter, comment out the row-level predicate appended by Cube, and retrieve warehouse rows explicitly denied by the access policy. **Root cause.** `PrestoDriver.prepareQueryWithParams()` used the MySQL-oriented `sqlstring` encoder, which escaped a quote as `\'`. Presto and Trino require doubled quotes, so the backend parsed the quote as the end of the literal after RLS compilation but before execu...

Domain-wide signup session enables cross-tenant administrator takeover

Winfunc Research — Mon, 27 Jul 2026 00:00:00 GMT

An unauthenticated attacker could complete public signup for their own Fider tenant, then present the temporary parent-domain cookie to an existing victim subdomain and be authenticated there with the attacker's Administrator role. **Root cause.** The JWT contained a global user ID but no tenant claim. Middleware loaded that ID through an unscoped query, and `dbEntities.User.ToModel` replaced the persisted tenant with the request tenant, making the final tenant equality check tautological while...

OAuth host poisoning enables cross-tenant account takeover

Winfunc Research — Mon, 27 Jul 2026 00:00:00 GMT

An attacker could start OAuth with a poisoned Host, receive the victim's still-unused provider code at an attacker origin, and redeem it on a chosen tenant by matching an unsigned `user_session_id` cookie. **Root cause.** `SignInByOAuth` derived its continuation from raw Host/X-Forwarded-Host and signed that origin into state. The callback redirected the provider code and identifier there, while `OAuthToken` neither revalidated the state nor consumed a server-side transaction and accepted a cal...

Oversized PostgreSQL startup frame can terminate the Cube service

Winfunc Research — Thu, 23 Jul 2026 00:00:00 GMT

Any network client reaching Cube's optional PostgreSQL SQL interface could send a four-byte frame length near `0xffffffff`, causing the native service to attempt a multi-gigabyte allocation before authentication and terminate under ordinary memory limits. **Root cause.** `read_contents()` accepted an untrusted unsigned protocol length, subtracted the header size, and resized a `Vec` to the declared body length without a server-owned maximum or fallible reserve. The same primitive affected start...

Traversing include paths allow cross-project YAML overwrite

Winfunc Research — Wed, 22 Jul 2026 00:00:00 GMT

A contributor to a lower-trust Meltano project could add a traversing `include_paths` pattern and cause an operator's routine configuration mutation to replace or blank a writable sibling project's valid YAML configuration. **Root cause.** `ProjectFiles._resolve_include_paths()` accepted any glob match that existed and was a file. `ProjectFiles.update()` later treated every accepted match as an authorized persistence destination, and `_write_file()` performed an atomic replacement without reche...