VulncastBriefing archive

Daily Brief - 2026-08-11

· 5 vulnerabilities · 6 min listen

▶ Listen to this briefing

CVE-2026-14450

critical · CVSS 9.9 · MaaS API

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

  • Authentication Bypass
  • Privilege Escalation
  • Insecure API
  • kubernetes
  • api
  • container orchestration

CVE-2026-72565

critical · CVSS 9.8 · Tencent APIJSON

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.

  • SQL Injection
  • api framework

CVE-2026-72898

critical · CVSS 10 · Metabase

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

  • SQL Injection
  • data analytics

CVE-2026-72902

critical · CVSS 9.9 · Dokploy

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.

  • Remote Code Execution
  • paas
  • deployment management

CVE-2026-72911

critical · CVSS 9.9 · Frappe ERPNext

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

  • Remote Code Execution
  • web application