Security Thursdays by yisusvii — 2026-08-27

Table of Contents

🚨 Cybersecurity News of the Week

1. Apache Tomcat — four authorization/authentication CVEs (Aug 25–26)

What happened: On August 25–26, 2026, NVD and the GitHub Advisory Database published four critical Apache Tomcat issues, with matching threads on the Apache announce lists and OSS-Security. Fixed versions are consistently 11.0.25, 10.1.58, and 9.0.121.

Who is affected: Tomcat 11.0.x through 11.0.24, 10.1.x through 10.1.57, and 9.0.x through 9.0.120 for the auth/constraint issues (exact lower bounds differ by CVE; CVE-2026-65637 starts later: 11.0.20 / 10.1.53 / 9.0.115). EOL 8.5.x and 7.0.x lines are called out as affected for several of these CVEs even though they are unsupported.

Why it matters: These are not exotic gadget chains. They hit how Tomcat enforces URL authorization and authenticator behavior — the control plane every WAR depends on. Constraint-order bugs are easy to miss in long web.xml / annotation sets. DIGEST and FORM issues matter anywhere those authenticators are still enabled, including legacy internal apps.

Exploitation: Not confirmed in sources reviewed for this digest.

Defender actions: Upgrade to fixed releases; re-read security-constraint ordering (most specific paths must win regardless of declaration order after the fix — still verify your config); disable unused DIGEST/FORM authenticators; regression-test protected POST-only endpoints.

Primary sources: GHSA-gcx9-497g-6cp6, GHSA-9xv2-5v5q-p794, GHSA-h3x4-894j-xpx5, GHSA-f525-44xv-f2qj; OSS-Security notes linked from those advisories (e.g. 2026/08/26/1, 2026/08/26/4, 2026/08/26/7).

2. Google Chrome 152.0.7977.65 — Critical sandbox escapes (Aug 25)

What happened: On August 25, 2026, Google published the stable-channel update to 152.0.7977.65. The GitHub Advisory Database ingested a large matching set the same day. Multiple issues are labeled Chromium security severity: Critical and describe remote code execution outside the sandbox via a crafted HTML page (user interaction: visit/render).

Representative Critical entry: CVE-2026-79290 — use-after-free in Aura, CVSS 3.1 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Adjacent Critical UAFs and memory-corruption bugs landed in ANGLE, Views, WebGL, Sessions, ServiceWorker, and related components (dozens of CVE IDs in the same release train).

Who is affected: Chrome/Chromium (and browsers that lag Chromium) prior to 152.0.7977.65. Enterprise Edge and other Chromium forks should be checked against their own build numbers.

Why it matters: “Outside the sandbox” is the difference between a renderer compromise and a full browser-compromise path. Patch latency on developer laptops and VDI images is still one of the most common enterprise exposure windows.

Exploitation: Not confirmed in sources reviewed here. Chromium Critical ratings still justify emergency fleet updates.

Defender actions: Push 152.0.7977.65+ via enterprise update channels; block outdated browser versions at the proxy where feasible; remind users that crafted pages remain the delivery path.

Primary sources: Chrome stable-channel update (Aug 2026), GHSA-rvcw-vfwg-f965 / CVE-2026-79290.

3. Trojanized pantheon-agents 0.6.1 / 0.6.2 on PyPI (advisory Aug 26)

What happened: On August 26, 2026, the PantheonOS maintainers published GHSA-93qj-5q5v-3c2h. The advisory states the PyPI publishing account was compromised during the June 2026 “Hades” PyPI supply-chain attack (described as Mini Shai-Hulud / Miasma lineage). Attackers used a stolen long-lived PyPI API token to upload trojanized wheels for pantheon-agents 0.6.1 and 0.6.2.

Important distinction: Only the PyPI artifacts for those two versions are affected. The GitHub source repository, git tags, and other channels are described as clean. Version 0.6.4 is listed as the patched package version on the advisory; maintainers also recommend installing from the clean GitHub source while PyPI distribution is recovered.

Impact (per advisory): Malicious wheels drop a *-setup.pth that runs on Python startup, pulls the Bun runtime, and runs an obfuscated credential stealer harvesting environment variables, ~/.pypirc, ~/.npmrc, cloud creds, SSH keys, and API tokens. Anyone who installed 0.6.1 or 0.6.2 should assume credentials on that host were exfiltrated.

Exploitation / campaign: The advisory attributes the upload to the earlier Hades campaign account compromise. Treat hosts that installed the bad versions as compromised for credential purposes.

Defender actions: Search lockfiles and images for pantheon-agents==0.6.1 / 0.6.2; uninstall; hunt IoCs (*-setup.pth, ~/.bun, unexpected _index.js); rotate all credentials that touched those hosts; prefer Trusted Publishing / short-lived tokens for your own packages; pin with hashes where possible.

Primary source: GHSA-93qj-5q5v-3c2h (also mirrored at github.com/advisories/GHSA-93qj-5q5v-3c2h).

4. Apache Camel — GitHub advisory wave for July disclosures (reviewed Aug 26)

What happened: Several Apache Camel CVEs that were originally disclosed around July 6, 2026 (and one JMS deserialization issue from April) received GitHub-reviewed advisory updates on August 26, 2026, with packaged Maven ranges and fixed versions aligned to 4.14.8, 4.18.3, and 4.21.0 (JMS original fix lines include 4.14.7 / 4.18.2 / 4.20.0). This is not a new zero-day disclosure this week — it is a meaningful ecosystem packaging and review event that will drive SCA scanner hits and dependency bots.

Highlights:

• CVE-2026-46454 (Critical, CVSS 9.8) — camel-cometd maps inbound Bayeux ext.CamelHeaders into the Exchange without a HeaderFilterStrategy, enabling unauthenticated Camel control-header injection when a client can complete the Bayeux handshake.
• CVE-2026-43865 (High, CVSS 8.1) — default-managed Hazelcast instances without a Java deserialization filter → RCE for an attacker who can join/reach the cluster.
• CVE-2026-43866 (High) — JMS ObjectMessage path allows DefaultExchangeHolder to bypass the earlier CVE-2026-40860 class allow-list hardening and inject Exchange state.
• Related component issues (PQC key-metadata deserialization, Vert.x/Netty HTTP transferException deserialization, AWS SNS defense-in-depth header filter, Docling argument injection) share the same fixed trains.

Who is affected: Applications on Camel 4.0+ (some JMS issues from 3.0.0) using the named components before the fixed releases above. Concrete risk depends on which components and endpoint options you actually run.

Defender actions: Inventory Camel components on the classpath; upgrade to the fixed minor lines; until then, strip inbound Camel* / camel* headers at route start, avoid untrusted JMS ObjectMessage consumers, and do not expose default Hazelcast cluster ports.

Primary sources: Camel security pages linked from the GHSAs (e.g. CVE-2026-46454, CVE-2026-43865); GHSA-r9cc-j7wr-p329, GHSA-xww8-mxqw-m84w, GHSA-f755-xp6r-8q84.

5. asyncssh — SCP path traversal to arbitrary file write (GHSA published Aug 26)

What happened: On August 26, 2026, the asyncssh project published GHSA-2wxc-x7rj-hg8f for CVE-2026-54591. NVD’s record is dated July 8, 2026; the actionable maintainer advisory and fix packaging landed in this research window. A malicious SSH server can return SCP filenames containing ../ (same class as OpenSSH’s CVE-2019-6111). asyncssh did not sanitize server-provided names on the receive path, enabling writes outside the destination directory (e.g. toward shell startup files or authorized_keys).

Fixed version: asyncssh 2.23.1 (vulnerable through 2.23.0).

Who is affected: Python clients using asyncssh SCP receive against servers they do not fully trust (or any server that could be redirected/MITM’d).

Defender actions: Upgrade to 2.23.1; prefer SFTP with explicit path handling; do not SCP from untrusted hosts in CI.

Primary source: GHSA-2wxc-x7rj-hg8f, v2.23.1 release.

🛡️ CVEs That Deserve Attention

CISA KEV and EPSS: not verified in this research run (feeds unreachable).

CVE-2026-65182 — Tomcat security constraint bypass

• Type: Improper access control / incorrect authorization (constraint ordering).
• Affected (advisory): 11.0.0-M1–11.0.24; 10.1.0-M1–10.1.57; 9.0.0.M1–9.0.120; also 8.5.0–8.5.100 and 7.0.0–7.0.109 (EOL).
• Fixed: 11.0.25, 10.1.58, 9.0.121.
• CVSS 3.1: 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) per GHSA.
• Prereqs: Attacker must reach a URL mapping where constraint order previously produced a weaker match.
• Priority: High (Emergency if Tomcat is internet-facing with complex constraints).
• Advisory: GHSA-gcx9-497g-6cp6

CVE-2026-65905 — Tomcat DIGEST capture-replay

• Type: Authentication bypass by capture-replay in the DIGEST authenticator.
• Detail: If a client sends a DIGEST request with nonceCount on the upper boundary of the replay window before windowSize requests, that request is replayable once while the nonceCount remains in-window.
• Affected: 11.0.0-M1–11.0.24; 10.1.0-M1–10.1.57; 9.0.0.M1–9.0.120 (+ EOL 8.5/7.0 ranges).
• Fixed: 11.0.25, 10.1.58, 9.0.121.
• CVSS 3.1: 9.8.
• Priority: High if DIGEST is enabled; Medium if authenticator is confirmed off everywhere.
• Advisory: GHSA-9xv2-5v5q-p794

CVE-2026-68525 — Tomcat FORM method bypass

• Type: Incorrect authorization in FORM authentication allowing bypass of a constraint that permits POST but not GET.
• Affected / fixed: Same supported trains as above → 11.0.25 / 10.1.58 / 9.0.121.
• CVSS 3.1: 9.1.
• Priority: High for apps that rely on HTTP-method-specific constraints with FORM auth.
• Advisory: GHSA-h3x4-894j-xpx5

CVE-2026-65637 — Tomcat incomplete fix for CVE-2026-32990

• Type: Improper input validation (residual after incomplete prior fix).
• Affected: 11.0.20–11.0.24; 10.1.53–10.1.57; 9.0.115–9.0.120.
• Fixed: 11.0.25, 10.1.58, 9.0.121.
• CVSS 3.1: 9.8.
• Priority: High — if you already “patched” for CVE-2026-32990 onto an intermediate build, verify you are not still inside this range.
• Advisory: GHSA-f525-44xv-f2qj

CVE-2026-79290 — Chrome Aura use-after-free (sandbox escape)

• Type: Use-after-free; Chromium severity Critical; RCE outside sandbox via crafted HTML.
• Affected: Chrome prior to 152.0.7977.65.
• Fixed: 152.0.7977.65 (stable channel update Aug 25, 2026).
• CVSS 3.1: 9.6 (UI:R, S:C).
• Priority: Emergency for unmanaged endpoints; High for centrally managed fleets with fast update rings.
• Advisory: GHSA-rvcw-vfwg-f965, Chrome release notes

CVE-2026-54591 — asyncssh SCP path traversal

• Type: CWE-22 path traversal on SCP receive.
• Affected: asyncssh ≤ 2.23.0 (pip).
• Fixed: 2.23.1.
• CVSS 3.1: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) — requires interaction with a malicious/compromised SSH server (or equivalent trust failure).
• Original NVD date: 2026-07-08; maintainer GHSA: 2026-08-26.
• Priority: High for automation that SCP-pulls from varied hosts; Medium if SCP is unused.
• Advisory: GHSA-2wxc-x7rj-hg8f

CVE-2026-46454 — Camel CometD header injection

• Type: Improper input validation — inbound Bayeux headers copied into Camel Exchange without HeaderFilterStrategy.
• Affected camel-cometd: ≥ 4.0.0 < 4.14.8; ≥ 4.15.0 < 4.18.3; ≥ 4.19.0 < 4.21.0.
• Fixed: 4.14.8 / 4.18.3 / 4.21.0.
• CVSS 3.1: 9.8 — unauthenticated client that can complete Bayeux handshake.
• Original disclosure: ~2026-07-06; GitHub reviewed: 2026-08-26.
• Priority: High if CometD endpoints are exposed; otherwise inventory-driven.
• Advisory: GHSA-r9cc-j7wr-p329, Camel CVE page

🔧 Basic Security Tool of the Week

gosec v2.29.0 — Go AST/SSA security checker

What it does: gosec statically inspects Go source via AST and SSA. Rule families cover hardcoded credentials, injection sinks, file/path risks, weak crypto/TLS, blocklisted imports, and taint-style flows (SQLi, command injection, path traversal, SSRF, XSS, unsafe deserialization, and more).

Who it is for: Go service developers, platform teams owning Go operators/controllers, and AppSec engineers adding a fast PR check.

Why this week: v2.29.0 released 2026-08-26 (changelog includes analyzer hardening such as no longer treating Clean/Abs/PathEscape as path-traversal sanitizers, report/format fixes, and Go toolchain updates). Actively maintained under Apache-2.0.

Install (pick one):

# Go toolchain (authorized dev machine)
go install github.com/securego/gosec/v2/cmd/gosec@v2.29.0

# Or pull the latest tagged module
go install github.com/securego/gosec/v2/cmd/gosec@latest

Official docs also support the securego/gosec GitHub Action and container images on GHCR.

Safe basic example (scan your module only):

cd /path/to/your-go-module
gosec -fmt text ./...
# optional machine-readable output for CI
gosec -fmt sarif -out gosec.sarif ./...

How to read results: Findings are rule IDs (G101 hardcoded credentials, G2xx injection, G3xx file/path, G4xx crypto, etc.). Severity and confidence vary — treat High+High as merge blockers, triage mediums with owners, and suppress only with documented #nosec justifications (gosec supports structured suppressions; do not blanket-ignore).

Limitations: Go-only; no substitute for dependency CVE scanning (pair with govulncheck or your SCA tool); taint rules can false-positive on framework helpers; always run on code you are authorized to analyze.

Links: Repository · v2.29.0 release · securego.io

💡 Security Tip of the Day

Today’s tip: Export a one-page inventory of every Apache Tomcat instance (version, hostname, internet-facing yes/no, authenticator valves in use) before you patch — then patch against that list, not against memory.

Why it matters: This week’s Tomcat CVEs span constraint evaluation and multiple authenticators. Teams that only upgrade the “main” prod cluster often leave QA, vendor appliances, and forgotten embedded Tomcat JARs on old builds — exactly where constraint and FORM/DIGEST oddities still matter.

How to apply it (≈10 minutes to start):

1. From your CMDB, Kubernetes cluster, or package inventory, list processes/images matching tomcat, catalina, or known base images.
2. Record Server version from logs or version.sh / image tags.
3. Note whether DigestAuthenticator or FormAuthenticator appears in server.xml / context config.
4. Schedule upgrades to 11.0.25 / 10.1.58 / 9.0.121 (or distro-backed equivalents) with a checkbox per instance.

Verify: After change windows, re-query the inventory — zero rows should remain on ≤11.0.24 / ≤10.1.57 / ≤9.0.120 for supported trains you still run.

✅ Security Actions for This Week

1. Emergency/High: Patch Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121 on internet-facing and SSO-fronted instances; confirm you are not stuck mid-range on CVE-2026-65637.
2. Emergency/High: Drive browsers to Chrome/Chromium ≥ 152.0.7977.65 (and matching Edge/Chromium forks).
3. High: Search build logs, lockfiles, and runtime images for pantheon-agents 0.6.1/0.6.2; if found, isolate host, remove package, hunt IoCs, and rotate credentials.
4. High: SCA-scan for vulnerable Apache Camel components (CometD, JMS family, Hazelcast, etc.) and plan upgrades to 4.14.8 / 4.18.3 / 4.21.0 as applicable; upgrade asyncssh to 2.23.1 where SCP is used.
5. Hygiene: Run gosec v2.29.0 on one authorized Go service and wire SARIF into CI; finish the Tomcat inventory tip above.

Sources

• GHSA-gcx9-497g-6cp6 — CVE-2026-65182 Apache Tomcat constraint bypass
• GHSA-9xv2-5v5q-p794 — CVE-2026-65905 Tomcat DIGEST replay
• GHSA-h3x4-894j-xpx5 — CVE-2026-68525 Tomcat FORM auth
• GHSA-f525-44xv-f2qj — CVE-2026-65637 Tomcat incomplete fix
• OSS-Security 2026/08/26/1, 2026/08/26/4, 2026/08/26/7
• Chrome stable-channel update for desktop (Aug 2026, 152.0.7977.65)
• GHSA-rvcw-vfwg-f965 — CVE-2026-79290 Chrome Aura UAF
• GHSA-93qj-5q5v-3c2h — pantheon-agents trojanized PyPI releases
• GHSA-r9cc-j7wr-p329 — CVE-2026-46454 Camel CometD
• Camel security: CVE-2026-46454
• GHSA-xww8-mxqw-m84w — CVE-2026-43865 Camel Hazelcast deserialization
• Camel security: CVE-2026-43865
• GHSA-f755-xp6r-8q84 — CVE-2026-43866 Camel JMS filter bypass
• GHSA-2wxc-x7rj-hg8f — CVE-2026-54591 asyncssh SCP traversal
• asyncssh v2.23.1
• gosec · gosec v2.29.0
• NVD detail pages linked from the GHSAs above (e.g. CVE-2026-65182, CVE-2026-79290, CVE-2026-54591)