Skip to content

JEDI-SEC | Security Research & Digital Defense

Home
Research
About
Recovered PDFs
#TG23: The First Signal
Office of Strategic Services
Darkz Youtube
Privacy Policy

Category: Vulnerabilities & Advisories

GHSA-3g3m-2fjr-6pw4: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
- Severity: MEDIUM
- CVE: CVE-2026-118773
- Ecosystems: npm
- Packages: glob
### Summary

In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background.

The root cause is that abort branches in src/walker.ts call cb() without returning. As a result, callers that rely on signal or AbortSignal.timeout() to bound glob traversal cost can still incur filesystem I/O and CPU work after the request has already been rejected.

### Details

This was reproduced on glob v13.0.6 (commit e80cb38ae60d6cbff9e75f39032a994858994d35).

The README documents that the signal option cancels the glob walk. However, in src/walker.ts, the following methods call cb() when this.signal?.aborted is true but do not return:

– GlobUtil.walkCB()
– GlobUtil.walkCB2()
– GlobUtil.walkCBSync()
– GlobUtil.walkCB2Sync()

Example vulnerable pattern:

if (this.signal?.aborted) cb()

Because execution continues after cb(), the walker still reaches processor.processPatterns(), readdirCB(), and recursive walkCB2() calls.

The issue was directly demonstrated against v13.0.6. A source-history review shows the same missing-return pattern is present in tagged releases from v9.0.0 through v13.0.6.

The issue affects both glob() and globStream().

Recommended fix:
Change each abort branch to return immediately:

if (this.signal?.aborted) return cb()

### Proof of concept

Environment:
– Linux x86_64
– Node.js v22.23.3
– npm 10.9.9
– glob 13.0.6

Reproduction steps:

1. Install the affected package:
npm init -y
npm install glob@13.0.…

Source: GitHub Security Advisories · 2026-10-30
October 30, 2026
GHSA-c73q-w75p-j82v: Authlib RFC 7592 examples omit registration-access-token client binding
- Severity: HIGH
- CVE: CVE-2026-116672
- Ecosystems: pip
- Packages: Authlib
## Description

### Summary

RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously registered client read, update, or delete its own registration, authenticated by a `registration_access_token` issued specifically to that client at registration time. The entire security model of this protocol depends on the server verifying that the token presented in the request actually belongs to the client identified in the request, not merely that the token is valid for some client.

Authlib’s `ClientConfigurationEndpoint` implements the control flow correctly in structure, calling `authenticate_token`, then `authenticate_client`, then `check_permission`, and treats all three as abstract methods that “Developers MUST implement in subclass.” The problem is that the documented example implementations for these methods, taken together exactly as written, never perform the one check that matters: binding the authenticated token to the specific client being accessed. A developer who implements these methods by following the provided examples ends up with a complete authorization bypass on this endpoint.

### Details

`authenticate_client`’s documented example (`authlib/oauth2/rfc7592/endpoint.py`):

“`python
def authenticate_client(self, request):
“””Read a client from the request payload.
Developers MUST implement this method in subclass::

def authenticate_client(self, request):
client_id = request.payload.data.get(“client_id”)
return Client.get(client…

Source: GitHub Security Advisories · 2026-10-30
October 30, 2026
ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158, (Fri, Oct 30th)

ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158, (Fri, Oct 30th)

Source: SANS Internet Storm Center · 2026-10-30

October 30, 2026
CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
- Vendor / product: Ivanti Connect Secure
- Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Federal due date: 2026-11-13
- Known ransomware campaign use: Unknown
- CWE: CWE-340
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-118527

Source: CISA Known Exploited Vulnerabilities · 2026-10-30
October 30, 2026
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
- Vendor / product: Ivanti Connect Secure
- Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Federal due date: 2026-11-02
- Known ransomware campaign use: Unknown
- CWE: CWE-306, CWE-862, CWE-345
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111357

Source: CISA Known Exploited Vulnerabilities · 2026-10-30
October 30, 2026
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)

Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it’s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to revert to a previous snapshot, all changes applied to the VM are… lost! Therefore, it’s important to store important data outside the VM.

Source: SANS Internet Storm Center · 2026-10-29

October 29, 2026
ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.7. The following CVEs are assigned: CVE-2026-71211.

Source: Zero Day Initiative — Published Advisories · 2026-10-29

October 29, 2026
ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-64849.

Source: Zero Day Initiative — Published Advisories · 2026-10-29

October 29, 2026
ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-37052.

Source: Zero Day Initiative — Published Advisories · 2026-10-29

October 29, 2026
ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-118628.

Source: Zero Day Initiative — Published Advisories · 2026-10-29

October 29, 2026

←Previous Page

1 2 3 4 … 11

JEDI-SEC | Security Research & Digital Defense

Independent security research. Practical digital defense.

NAVIGATION

Home
Research
About

JEDI-SEC // Verify claims. Protect systems. Share knowledge.