Security Thursdays by yisusvii — 2026-09-04

Table of Contents

🚨 Cybersecurity News of the Week

1. SeaweedFS — unauthenticated filer IAM gRPC and follow-on auth bugs (advisories through Sep 2)

What happened: On September 2, 2026, GitHub published GHSA-2v6v-25fm-p4fg for CVE-2026-72920. The filer registered the IAM gRPC service (SeaweedIdentityAccessManagement) with no authentication. Any client that could reach the filer gRPC port could call CreateUser, CreateAccessKey, PutUserPolicy, and related RPCs to mint credentials and grant itself S3 administrative control. Documented JWT signing keys did not gate this service. CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The same day, GHSA-gv5w-hfx8-8cwq / CVE-2026-72921 (CVSS 3.1 8.1) documented a multi-tenant JWT allowed_prefixes bypass: literal strings.HasPrefix matching meant a token scoped to /tenant1 also authorized /tenant1234 and similar siblings. Both issues are fixed in SeaweedFS 4.24.

Separately in this research window, GHSA-56wq-x3wv-3ff4 / CVE-2026-55874 (High, CVSS 3.1 7.7, published August 28) covers path traversal in the S3 gateway X-Amz-Copy-Source header — an incomplete follow-up to an earlier URL-path hardening — fixed in 4.34.

Who is affected: SeaweedFS deployments exposing filer gRPC and/or the S3 gateway prior to the fixed releases above. Multi-tenant filer JWT prefix configs are in scope for CVE-2026-72921.

Why it matters: Object-storage control-plane bugs convert network reachability into full data-plane compromise. Unauthenticated IAM minting is an emergency-class exposure wherever the filer port is reachable beyond a tight trust boundary.

Exploitation: Not confirmed in sources reviewed for this digest.

Defender actions: Upgrade to ≥ 4.34 (or at minimum ≥ 4.24 plus the 4.34 copy-source fix); restrict filer gRPC to trusted hosts; ensure jwt.filer_signing.key is set post-upgrade; rotate S3 credentials if the IAM port was exposed; review multi-tenant prefix naming.

Primary sources: GHSA-2v6v-25fm-p4fg, GHSA-gv5w-hfx8-8cwq, GHSA-56wq-x3wv-3ff4.

2. Orval — import-time RCE cluster from hostile OpenAPI specs (Sep 2–3)

What happened: Between September 2–3, 2026, the Orval maintainers and GitHub Advisory Database published a large set of Critical advisories for the orval OpenAPI client generator. Representative entry: GHSA-6mr6-jvcr-2f25 / CVE-2026-71866 — schema property names were emitted as unescaped keys inside generated zod.object({...}) literals. A crafted property name can break out into a computed property that executes when the generated module is imported (import-time RCE). Sibling Critical issues cover query/header parameter names, enum/array/schema defaults as template-literal breakouts, OpenAPI path and servers[].url request-URL template injection, and MSW mock generator key injection. Fixed floor for the RCE set: orval 8.21.0.

A related High issue, GHSA-cxq5-97v7-87j8 / CVE-2026-62680, covers generation-time SSRF / LFI via unrestricted $ref, fixed in 8.22.0.

Who is affected: Teams that run Orval < 8.21.0 (RCE) or < 8.22.0 ($ref) against OpenAPI documents that are not fully trusted (vendor specs, user-uploaded specs, weakly gated internal registries).

Why it matters: Code generators sit early in CI. “We only generate types” is not a safety boundary when generated modules execute attacker-controlled expressions at import time.

Exploitation: Not confirmed in the wild in sources reviewed; advisories include maintainer-verified reproduction against Orval 8.19.0.

Defender actions: Upgrade to ≥ 8.22.0 (current latest at research time includes 8.28.x); regenerate and review clients; treat external OpenAPI as untrusted input; avoid importing generated clients in privileged CI jobs until regenerated from a patched Orval.

Primary sources: GHSA-6mr6-jvcr-2f25, GHSA-fg9p-mrxr-hvq7 (path template RCE), GHSA-cxq5-97v7-87j8.

3. pnpm — install-time path escapes and workspace secret expansion (Sep 1–2)

What happened: pnpm published multiple High advisories in this window:

Who is affected: CI and developer machines running vulnerable pnpm that install dependencies from attacker-influenced lockfiles, tarball deps, or workspace config.

Why it matters: --ignore-scripts is a common “safe install” control. CVE-2026-82393 explicitly defeats that assumption for the isolated-linker import path. Lockfiles and workspace YAML are part of the trusted computing base.

Exploitation: Not confirmed in sources reviewed.

Defender actions: Upgrade package-manager binaries in images and corepack pins; require code review on lockfile and pnpm-workspace.yaml changes; avoid installing untrusted tarball/git dependencies on build agents with broad filesystem/credentials.

Primary sources: GHSA-c59q-g84q-2gj5, GHSA-vq4v-j7r6-jq4m, GHSA-vx52-2968-3vc6.

4. NLTK — fail-open pathsec default and incomplete JVM-options fix (Aug 31–Sep 2)

What happened: NLTK’s security advisory wave continued through early September:

• CVE-2026-62388 / GHSA-p3m8-78j2-g5p3 — nltk.pathsec defaulted to ENFORCE=False, so path/URL/pickle gates only emitted RuntimeWarning unless NLTK_PATHSEC_ENFORCE was set. That undermined earlier remediations (including pickle/path issues). Fixed floor called out as 3.10.0.
• CVE-2026-79675 / GHSA-m4rf-3fr8-xwx3 (Critical, CVSS 3.1 9.8) — incomplete fix of CVE-2026-12841: _validate_java_options() ran on config_java() global options but not on the per-call options= path used by Stanford wrappers → JVM argument injection. Fixed in 3.10.3.

Additional High/Medium path, downloader, and DoS issues in the same series share the 3.10.3 train for several fixes.

Who is affected: Python services and notebooks using NLTK ≤ 3.10.2 (and especially ≤ 3.9.4 for the ENFORCE default), including ML pipelines that shell out to Stanford Java tools via NLTK wrappers.

Why it matters: “We already patched NLTK” is insufficient if an incomplete fix left a second options path open, or if pathsec never enforced by default.

Exploitation: Not confirmed in sources reviewed.

Defender actions: Upgrade to ≥ 3.10.3; verify nltk.pathsec.ENFORCE is true in production images; avoid passing untrusted java_options into Stanford wrappers; rotate any secrets that sat on hosts that processed untrusted corpora with old builds if warranted by your threat model.

Primary sources: GHSA-p3m8-78j2-g5p3, GHSA-m4rf-3fr8-xwx3.

5. fast-uri, OpenChoreo, and database-driver credential leaks (Aug 28–Sep 3)

fast-uri (Sep 2): Four High advisories (e.g. GHSA-fph4-wmhf-6fwf / CVE-2026-75899) describe SSRF/host-confusion via double percent-decoding, malformed IPv6 normalization, percent-encoded scheme confusion, and skipped IDN canonicalization on scheme-relative references. Incomplete-fix lineage relative to earlier encoded-authority work. Patched in 2.4.5, 3.1.6, and 4.1.3 (later 2.4.6 / 4.1.4 also published on npm).

OpenChoreo (Sep 2): GHSA-qh9r-j7rp-4x2m / CVE-2026-73843 (Critical, CVSS 3.1 9.6, adjacent network) — multi-cluster cluster-gateway served unauthenticated caller-facing management APIs on the same externally published listener used for data-plane agents, enabling privileged data-plane operations (including Kubernetes API proxying / pod exec class impact per advisory). Fixed in 1.0.2, 1.1.2, 1.2.0. Related High command-injection and cross-project issues landed the same day.

Node database drivers: GHSA-3f6p-5ww8-9rcr — mysql2 auth-plugin downgrade to mysql_clear_password leaks plaintext credentials to a rogue/MITM server without requiring TLS (fixed 3.22.0). GHSA-cqhc-2h57-wpxf / CVE-2026-55215 — mariadb connector can send the password before fingerprint validation completes when SSL is enabled without a CA/server cert (fixed 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3).

Defender actions: SCA-bump fast-uri transitives; patch OpenChoreo gateways and restrict external listeners; upgrade mysql2/mariadb drivers and require proper TLS verification (CA + VERIFY mode).

🛡️ CVEs That Deserve Attention

CISA KEV and EPSS: not verified in this research run (feeds unreachable).

CVE-2026-72920 — SeaweedFS unauthenticated filer IAM

• Type: Missing authentication for critical function (IAM gRPC).
• Affected: SeaweedFS prior to the 4.24 fix (Go module pseudo-version floor 0.0.0-20260512171108-5e8f99f40a8a in the advisory database).
• Fixed: 4.24 — IAM RPCs require admin-signed tokens; service refuses to register without jwt.filer_signing.key.
• CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N).
• Prereqs: Network reachability to filer gRPC port.
• Priority: Emergency if filer gRPC is reachable beyond a strict admin network; otherwise High.
• Advisory: GHSA-2v6v-25fm-p4fg

CVE-2026-72921 — SeaweedFS JWT allowed_prefixes bypass

• Type: Incorrect authorization (literal prefix match).
• Fixed: 4.24 (component-aware match after path.Clean).
• CVSS 3.1: 8.1 (PR:L — valid scoped token required).
• Priority: High for multi-tenant filer deployments.
• Advisory: GHSA-gv5w-hfx8-8cwq

CVE-2026-55874 — SeaweedFS S3 Copy-Source traversal

• Type: Path traversal / confused-deputy bucket isolation break on CopyObject / UploadPartCopy.
• Affected: All releases prior to 4.34 (URL path was hardened earlier; header path was not).
• Fixed: 4.34+.
• CVSS 3.1: 7.7 (PR:L, S:C).
• Original meaningful development this week: advisory packaging 2026-08-28 in the GitHub Advisory Database.
• Priority: High for multi-bucket S3 gateway tenants.
• Advisory: GHSA-56wq-x3wv-3ff4

CVE-2026-71866 — Orval zod property-name injection (representative)

• Type: Code injection / improper neutralization in generated JS (CWE-94/95/116 class per advisory).
• Affected orval: < 8.21.0
• Fixed: 8.21.0 (pair with 8.22.0 for CVE-2026-62680 $ref SSRF).
• CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H (Critical) on the OSV record.
• Prereqs: Generation (and later import) of a client from an attacker-influenced OpenAPI document.
• Priority: High (Emergency if CI auto-generates from untrusted specs).
• Advisory: GHSA-6mr6-jvcr-2f25 — see also sibling RCE GHSAs in the Sep 2–3 Orval batch.

CVE-2026-82393 / CVE-2026-82392 — pnpm install path issues

• Types: Arbitrary file write via malicious tarball name; virtual-store path traversal via lockfile depPath.
• Affected: pnpm < 10.34.5 on 10.x; ≥ 11.0.0 < 11.11.0 on 11.x (see each advisory for exact ranges; workspace secret issue also lists ≥ 10.7.0).
• Fixed: 10.34.5, 11.11.0 (later 11.x/12.x trains continue past these floors).
• CVSS 3.1: 7.5 (82393), 7.1 (82392); both need user interaction in the sense of running install against attacker-influenced inputs.
• Priority: High for shared CI runners and developer laptops.
• Advisories: GHSA-vq4v-j7r6-jq4m, GHSA-c59q-g84q-2gj5

CVE-2026-75899 — fast-uri double decode SSRF

• Type: SSRF / host confusion via repeated hostname percent-decoding (incomplete-fix variant).
• Affected: 2.4.1–<2.4.5; 3.1.2–<3.1.6; 4.0.0–<4.1.3 (sibling CVEs expand other confusion classes on overlapping ranges).
• Fixed: 2.4.5 / 3.1.6 / 4.1.3
• CVSS 3.1: 7.5 (C:N/I:H/A:N integrity-focused host confusion).
• Priority: High where user-controlled URLs are normalized before allowlists; Medium if no URL SSRF surface.
• Advisory: GHSA-fph4-wmhf-6fwf

CVE-2026-79675 — NLTK JVM options bypass

• Type: Argument injection (CWE-88), incomplete fix of CVE-2026-12841.
• Affected: NLTK ≤ 3.10.2
• Fixed: 3.10.3
• CVSS 3.1: 9.8
• Priority: High if Stanford wrappers accept attacker-influenced java_options; Medium if those code paths are unused.
• Advisory: GHSA-m4rf-3fr8-xwx3

CVE-2026-73843 — OpenChoreo unauthenticated cluster-gateway management APIs

• Type: Missing authentication on management APIs colocated with externally published agent listener.
• Affected: < 1.0.2; 1.1.x < 1.1.2 (1.2 line fixed at 1.2.0).
• Fixed: 1.0.2 / 1.1.2 / 1.2.0
• CVSS 3.1: 9.6 (AV:A, S:C)
• Priority: Emergency for multi-cluster topologies with external cluster-gateway; Monitor if gateway is never published externally.
• Advisory: GHSA-qh9r-j7rp-4x2m

🔧 Basic Security Tool of the Week

OSV-Scanner v2.5.1 — dependency vulnerability scanner (OSV.dev frontend)

What it does: OSV-Scanner maps your lockfiles, manifests, OS packages, and container images to the public OSV.dev vulnerability database (GitHub Advisory Database, ecosystem DBs, distro trackers, and more). V2 sits on OSV-Scalibr and supports source scans, image scans, license checks, and optional guided remediation for some ecosystems.

Who it is for: Developers, DevOps/SRE, and AppSec teams that need a fast, offline-friendly-capable SCA check across npm/pnpm, pip, Go modules, Maven, and others — especially useful this week for catching pnpm, orval, fast-uri, NLTK, and driver bumps in one pass.

Why this week: Different category from last week’s gosec (Go SAST). OSV-Scanner is actively maintained (latest tag v2.5.1); Apache-2.0; official Google OSS frontend to OSV. Ideal for validating the supply-chain CVEs above against your authorized repos and images.

Install (pick one, authorized machine only):

# Recommended: pinned release binary from GitHub Releases
# https://github.com/google/osv-scanner/releases/tag/v2.5.1

# Or build with Go toolchain
go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.5.1

Safe basic example (scan your project tree only):

cd /path/to/your-authorized-repo
osv-scanner scan source -r .
# optional JSON for CI artifacts
osv-scanner scan source -r . --format json --output osv-results.json

How to read results: Each hit ties a package version to an OSV/GHSA/CVE ID. Prioritize fixed-version available + direct dependencies + issues matching this week’s themes (package managers, generators, URI libs, ML libs). Use call analysis only where documented for your language; do not treat every transitive Low as a pager event.

Limitations: Database coverage depends on OSV sources (excellent for open-source ecosystems; not a substitute for vendor closed-source PSAIRT feeds). Guided remediation can invoke package managers — run only on trusted projects. Container scans need local/authorized image access. Always scan systems you own or are explicitly authorized to test.

Links: Repository · v2.5.1 release · Documentation · Installation

💡 Security Tip of the Day

Today’s tip: Pin the package-manager binary version in CI (corepack, asdf, mise, or image digest) and fail the job if pnpm -v / npm -v / yarn -v drifts — do not rely on “whatever latest the runner cached.”

Why it matters: This week’s pnpm advisories are fixed at specific floors (10.34.5, 11.11.0). Floating package managers silently reintroduce install-time path and workspace bugs even when application lockfiles look fine. The same pattern applies to codegen CLIs like Orval.

How to apply it (≈10 minutes to start):

1. Record the intended version in package.json#packageManager (Corepack) or your toolchain file.
2. In CI, print and assert the version before pnpm install / npm ci.
3. Rebuild builder images so the binary matches the pin; block merges that change the pin without review.

Verify: A pipeline log line shows the expected version (e.g. pnpm 10.34.5 or 11.11.0+), and a deliberate downgrade fails the assertion step.

✅ Security Actions for This Week

1. Emergency/High: Patch SeaweedFS to ≥ 4.34 (or ≥ 4.24 immediately, then 4.34); restrict filer gRPC; rotate S3/IAM credentials if the IAM port was exposed.
2. High: Upgrade pnpm to ≥ 10.34.5 or ≥ 11.11.0 everywhere installs run; pin and assert the version in CI (tip above).
3. High: Upgrade orval to ≥ 8.22.0, regenerate clients from trusted specs only, and SCA-bump fast-uri to patched trains.
4. High: Move NLTK to ≥ 3.10.3; upgrade mysql2 ≥ 3.22.0 and mariadb connector fixed branches; patch OpenChoreo gateways if you run multi-cluster topologies.
5. Hygiene: Run OSV-Scanner v2.5.1 on one authorized monorepo (osv-scanner scan source -r .) and file tickets for direct dependency hits tied to this digest.

Sources

• GHSA-2v6v-25fm-p4fg — CVE-2026-72920 SeaweedFS unauthenticated filer IAM
• GHSA-gv5w-hfx8-8cwq — CVE-2026-72921 SeaweedFS JWT allowed_prefixes
• GHSA-56wq-x3wv-3ff4 — CVE-2026-55874 SeaweedFS X-Amz-Copy-Source traversal
• GHSA-6mr6-jvcr-2f25 — CVE-2026-71866 Orval zod property-name RCE
• GHSA-fg9p-mrxr-hvq7 — CVE-2026-62681 Orval path template RCE
• GHSA-cxq5-97v7-87j8 — CVE-2026-62680 Orval $ref SSRF/LFI
• GHSA-c59q-g84q-2gj5 — CVE-2026-82392 pnpm virtual-store path traversal
• GHSA-vq4v-j7r6-jq4m — CVE-2026-82393 pnpm tarball name arbitrary write
• GHSA-vx52-2968-3vc6 — pnpm workspace env-placeholder secret expansion
• GHSA-p3m8-78j2-g5p3 — CVE-2026-62388 NLTK pathsec ENFORCE default
• GHSA-m4rf-3fr8-xwx3 — CVE-2026-79675 NLTK JVM options incomplete fix
• GHSA-fph4-wmhf-6fwf — CVE-2026-75899 fast-uri double percent-decode
• GHSA-f65p-4m7j-42xc — CVE-2026-75975 fast-uri IPv6 normalization SSRF
• GHSA-qh9r-j7rp-4x2m — CVE-2026-73843 OpenChoreo cluster-gateway
• GHSA-3f6p-5ww8-9rcr — mysql2 cleartext auth-plugin downgrade
• GHSA-cqhc-2h57-wpxf — CVE-2026-55215 mariadb connector password-before-verify
• GHSA-4mvj-m6j5-pmf7 — CVE-2026-71428 unstructured URL partition SSRF
• GHSA-mpf4-983q-p7j4 — CVE-2026-82397 Tornado urlencoded field DoS
• GitHub Advisory Database (OSV-compatible API)
• OSV-Scanner repository · v2.5.1