Security Thursdays by yisusvii — 2026-09-17

Table of Contents

🚨 Cybersecurity News of the Week

1. Traefik — multi-issue edge release (HTTP/3 identity reuse, path bypass, h2c tunnel, trailers) (Sep 10)

What happened: On September 10, 2026, Traefik published a coordinated set of advisories fixed in v3.7.13 and v2.11.57:

Who is affected: Traefik v3 lines below 3.7.13 (many EOL 3.x trains must jump to 3.7.13); v2 below 2.11.57 for the first three issues. Trailer issue is v3-only (custom reverse proxy); v2 uses stdlib ReverseProxy and is not affected by CVE-2026-88004. Preconditions differ: NTLM issue needs HTTP/3 + connection-bound backend auth; h2c issue needs a backend that upgrades h2c without validating Connection (advisory notes common off-the-shelf servers were not exploitable in testing); rootless target issue needs no special config — stock entrypoint defaults.

Why it matters: Traefik is a default edge for Kubernetes ingress, homelabs, and internal platforms. Failures here convert path-scoped auth middleware into theater and can hand a second client a victim’s backend connection identity.

Exploitation status: Not confirmed in the wild in sources reviewed. Advisories include detailed technical validation.

Defender actions: Upgrade to patched releases; inventory HTTP/3 enablement and NTLM/Negotiate backends; review whether any origin accepts non-WebSocket upgrades; treat access logs that only show GET / as insufficient for opaque-target detection until patched; rotate credentials for backends that used connection-bound auth if HTTP/3 was exposed while vulnerable.

Primary sources: vendor GHSAs and v3.7.13 / v2.11.57 releases.

2. rclone — serve s3 SigV4 auth bypass and RC auth-proxy failures (Sep 10)

What happened: On September 10, 2026, rclone published multiple advisories fixed in v1.75.1. The headline critical is GHSA-xwwr-4h3p-r22c / CVE-2026-88018: with rclone serve s3 --auth-proxy and without --auth-key, the server registers client-chosen access keys against an empty shared secret, so any caller can compute a valid SigV4 signature — full authentication bypass. Related critical GHSA-p569-5gjg-9cmj / CVE-2026-88044 (RC serve/start per-server proxyOpt): FTP/S3 constructors check process-global proxy.Opt.AuthProxy instead of the request-local option, so configured auth-proxy is silently ignored (FTP can fall back to anonymous defaults). High CVE-2026-88017 covers FTP cross-session auth-proxy backend confusion.

Who is affected: CVE-2026-88018: rclone < 1.75.1 when serve s3 uses --auth-proxy without --auth-key (the combination documentation presents as standalone). CVE-2026-88044: ≥ 1.70.0, < 1.75.1 for RC-started serve with nested proxyOpt. Dedicated CLI serve paths that set process-global auth-proxy are not affected by the RC mismatch.

Why it matters: rclone serve is a common way to expose object storage or remote backends to apps and CI. Auth that fails open is equivalent to publishing the backend.

Exploitation status: Not confirmed in the wild in sources reviewed.

Defender actions: Upgrade to ≥ 1.75.1; inventory all serve s3 / RC serve processes; do not rely on auth-proxy alone for S3 without understanding key material; rotate backend credentials if a vulnerable serve endpoint was reachable.

Primary sources: linked GHSAs; rclone v1.75.1.

3. MCP servers — unauthenticated SQL, GitLab PAT theft, DNS rebinding (Sep 11–16)

What happened: MCP bridges continue to expand attack surface for agent tooling.

• September 11: GHSA-rqfv-2mw9-78g2 / CVE-2026-59971 (CVSS 3.1 10.0): mysql-mcp-server in SSE transport (MCP_TRANSPORT=sse) builds SseServerTransport without DNS-rebinding protection, binds 0.0.0.0, and exposes unauthenticated routes that reach execute_sql. Default stdio mode is not affected. Advisory states internet-wide scanning found 25 publicly reachable SSE instances (researcher/vendor exposure claim). Fixed 0.4.2.
• September 15–16: @zereight/mcp-gitlab cluster — CVE-2026-61560 unauthenticated SSE + upload_markdown arbitrary file read → PAT exfiltration (GHSA-cv3r-c5h8-f4g5, fixed 2.1.27); CVE-2026-61559 SSRF via X-GitLab-API-URL when ENABLE_DYNAMIC_API_URL=true (same floor); CVE-2026-61568 DNS rebinding on Streamable HTTP (GHSA-vmp7-252j-cwp7, fixed 2.1.30); plus safety-control bypasses on GraphQL/read-only mode (GHSA-5648-rgj9-v224, fixed 2.1.30).

Who is affected: Operators running these MCP packages with HTTP/SSE transports, especially Docker defaults that publish ports on all interfaces.

Why it matters: MCP servers often hold long-lived PATs, DB credentials, and run beside developer laptops or agent hosts. “Local tool” assumptions collapse when SSE listens on 0.0.0.0 without Origin/Host checks.

Exploitation status: Not confirmed mass exploitation; MySQL MCP advisory cites publicly reachable instances as exposure evidence only.

Defender actions: Patch to floors above; prefer stdio or loopback-only binds; require auth on any remote MCP transport; disable dynamic API URL features unless strictly needed; rotate GitLab PATs and DB credentials if SSE was exposed; scan inventory for mcp containers and compose stacks.

Primary sources: vendor GHSAs linked above.

4. Identity and cloud-security products — Prowler SAML cross-tenant ATO; ZITADEL token exchange (Sep 11–14)

What happened:

• September 11: GHSA-h8m9-jgf8-vwvp / CVE-2026-59151 (CVSS 3.1 9.6): Prowler’s SAML ACS finish path derived the destination tenant from the asserted email domain instead of binding issuance to the SAML configuration validated for the ACS route. A malicious tenant with its own IdP could complete a valid SAML flow while asserting an email domain belonging to another tenant, receiving a token for the wrong tenant. Fixed prowler-cloud 5.30.3.
• September 14: GHSA-vrh8-c9cm-wh8v / CVE-2026-56668 (CVSS 3.1 8.1): ZITADEL OAuth2 token exchange failed to verify that the subject token belonged to the exchanging client and failed to constrain requested scopes to a subset of the original token — allowing exchange from a low-privilege app toward a higher-privilege audience. Affected 4.0.0–4.15.2 and 3.0.0–3.4.12 per vendor advisory text; GitHub Advisory Database lists first patched version 4.15.3. Operators still on 3.x should confirm the supported remediation path on the vendor advisory (the published patch guidance points at ≥ 4.15.3).

Why it matters: Multi-tenant SaaS control planes and identity providers are high-value; tenant mix-ups and scope escalation bypass project-level authorization design.

Exploitation status: Not confirmed in the wild in sources reviewed.

Defender actions: Upgrade Prowler and ZITADEL; review SAML domain claims and who can configure IdPs; audit token-exchange grant usage and public clients; revoke sessions if multi-tenant SAML was enabled on vulnerable Prowler.

Primary sources: linked GHSAs; Prowler 5.30.3; ZITADEL v4.15.3.

5. http4s Ember request smuggling + other high-signal items (Sep 10–16)

Additional items worth tracking:

• http4s Ember (Sep 15): critical CVE-2026-69204 CL.TE (accepts both Transfer-Encoding and Content-Length) and high CVE-2026-69205 TE case-sensitivity / substring bugs — request smuggling when Ember is origin behind a disagreeing intermediary. Fixed 0.23.35 and 1.0.0-M47 (GHSA-8h4c-x2wg-6xp8, GHSA-9998-894r-fwvr).
• Central Dogma (Sep 11): CVE-2026-11746 hard-coded ZooKeeper replication secret ch4n63m3 with silent fallback when replication.secret omitted — cluster takeover class for replication.method=ZOOKEEPER. Fixed 0.84.0 (GHSA-2j95-gqxf-v3vg). Standalone NONE mode not applicable.
• Open WebUI (Sep 10): CVE-2026-87016 SQLite OAuth subject lookup uses SQL wildcards — possible sign-in as another user when subject claim is attacker-influenced; PostgreSQL path not affected. Fixed 0.11.1 (GHSA-wpmr-8h3q-fwj7).
• ESPHome Device Builder (Sep 14): CVE-2026-59178 renamed auth env vars (USERNAME/PASSWORD → ESPHOME_*) silently disabled dashboard auth on upgrade. Fixed 1.0.12 with deprecated fallback (GHSA-rrxg-g2pf-6hh4).
• lmdeploy (advisory published Sep 16; CVE ID CVE-2025-59953): pickle deserialization RCE in ZMQ RPC call_and_response — not newly assigned this week, but the GHSA/package fix floor 0.10.2 is a material in-window development. Do not present as a brand-new 2026 CVE mint; treat as patch-now if RPC is exposed (GHSA-5h8j-6crg-7rmw).

🛡️ CVEs That Deserve Attention

CVE-2026-88007 — Traefik HTTP/3 NTLM/Negotiate connection reuse

• Product / versions: Traefik v3 ≥ 3.0.0, < 3.7.13 → 3.7.13; v2 ≥ 2.11.0, < 2.11.57 → 2.11.57
• Type: Missing per-connection transport isolation on HTTP/3 → backend identity inheritance
• Prereqs: HTTP/3 enabled; backend uses connection-bound NTLM or Negotiate; backend keep-alive. Ordinary per-request auth not affected per advisory
• CVSS: Not published on the GHSA record reviewed (severity critical)
• KEV / EPSS: Not independently verified (feeds unreachable)
• Public exploit: Advisory includes validated reproduction narrative; no separate mass-exploit claim
• Priority: Emergency if HTTP/3 fronts NTLM/Negotiate backends; High for general Traefik fleets (patch with siblings)
• Advisory: GHSA-qqjf-53cj-pwvv

CVE-2026-88009 — Traefik rootless request-target routing bypass

• Product / versions: v3 < 3.7.13; v2 < 2.11.57
• Type: Opaque/rootless request-target normalized to / for routing/middleware/logging while forwarded verbatim
• Prereqs: Unauthenticated client; stock entrypoint defaults sufficient per advisory
• Priority: High (Emergency where path-scoped forwardAuth is the sole gate on sensitive backends)
• Advisory: GHSA-f52w-8j3h-j724

CVE-2026-88008 — Traefik h2c Upgrade middleware bypass

• Product / versions: v3 ≥ 3.4.2, < 3.7.13; v2 ≥ 2.11.26, < 2.11.57
• Type: Unrestricted Upgrade: h2c forwarding → post-101 raw tunnel skips router/middleware
• Prereqs: Backend that honors h2c upgrade without proper Connection validation; advisory states common off-the-shelf servers were not exploitable in testing
• Priority: High when custom/internal backends implement h2c upgrade; Medium/Monitor if backends are known non-upgrading
• Advisory: GHSA-w4v4-9rw7-5326

Also patch CVE-2026-88004 (trailer sanitization bypass) on v3 ≥ 3.2.0, < 3.7.13 — GHSA-v67p-phpq-fc8x.

CVE-2026-88018 — rclone serve s3 SigV4 bypass

• Product / versions: rclone < 1.75.1; fixed 1.75.1
• Type: Authentication bypass (empty SigV4 secret registration under --auth-proxy without --auth-key)
• Prereqs: Network reachability to serve s3 with that flag combination
• CVSS: 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• Priority: Emergency for any internet- or org-reachable vulnerable serve endpoint; High for internal-only
• Related: CVE-2026-88044 RC auth-proxy ignore (CVSS 3.1 9.1); CVE-2026-88017 FTP session confusion (CVSS 3.1 7.3)
• Advisory: GHSA-xwwr-4h3p-r22c

CVE-2026-59971 — MySQL MCP Server unauthenticated SQL (SSE)

• Product / versions: mysql-mcp-server < 0.4.2; fixed 0.4.2
• Type: Missing auth + missing Origin/Host validation on SSE transport → arbitrary SQL
• Prereqs: MCP_TRANSPORT=sse (stdio default not affected); network path to service
• CVSS: 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
• Priority: Emergency for any non-stdio deployment; disable SSE exposure immediately if you cannot patch
• Advisory: GHSA-rqfv-2mw9-78g2

CVE-2026-61560 — @zereight/mcp-gitlab unauthenticated file read / PAT theft

• Product / versions: npm @zereight/mcp-gitlab < 2.1.27 (file read); take ≥ 2.1.30 for DNS-rebinding and control-bypass follow-ons
• Type: Missing SSE auth + path traversal/arbitrary read via upload_markdown
• Prereqs: SSE=true (Docker default path per advisory); network reachability
• CVSS: 3.1 9.8
• Related: CVE-2026-61559 SSRF (CVSS 3.1 9.6); CVE-2026-61568 DNS rebinding (CVSS 3.1 9.6)
• Priority: Emergency for exposed SSE/Docker publishes; High for loopback-only agent hosts (still patch; DNS rebinding remains relevant)
• Advisory: GHSA-cv3r-c5h8-f4g5

CVE-2026-59151 — Prowler SAML cross-tenant account takeover

• Product / versions: prowler-cloud < 5.30.3; fixed 5.30.3
• Type: Incorrect tenant binding after SAML ACS (email-domain trust)
• Prereqs: Multi-tenant Prowler with SAML; attacker controls a tenant IdP and can assert emails for another domain configuration path as described in advisory
• CVSS: 3.1 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
• Priority: Emergency for multi-tenant SAML deployments; Monitor if SAML is unused
• Advisory: GHSA-h8m9-jgf8-vwvp

CVE-2026-56668 — ZITADEL OAuth2 token-exchange privilege escalation

• Product / versions: Affected 4.0.0–4.15.2 and 3.0.0–3.4.12 per vendor text; first patched version in GHSA DB 4.15.3
• Type: Missing audience ownership + scope subset checks on token exchange
• Prereqs: Authenticated user/client that can call token exchange; risk higher with public clients
• CVSS: 3.1 8.1
• Priority: High wherever token exchange is enabled; disable the grant type until patched if unused
• Advisory: GHSA-vrh8-c9cm-wh8v

CVE-2026-69204 — http4s Ember CL.TE request smuggling

• Product / versions: http4s-ember-core ≤ 0.23.34 → 0.23.35; 1.0.0-M1–M46 → 1.0.0-M47
• Type: HTTP request smuggling (TE+CL both accepted)
• Prereqs: ember-server as origin behind intermediary that forwards both headers and frames by Content-Length on keep-alive
• Priority: High in reverse-proxy chains; Medium for direct-only exposure with no intermediary
• Sibling: CVE-2026-69205 TE parsing (CVSS 3.1 8.7)
• Advisory: GHSA-8h4c-x2wg-6xp8

🔧 Basic Security Tool of the Week

Checkov 3.3.x — IaC and cloud misconfiguration scanning

What it does: Checkov is an open-source static analyzer for infrastructure as code and related artifacts. It evaluates Terraform, CloudFormation, Kubernetes/Helm/Kustomize, Dockerfiles, Bicep/ARM, CI workflow files, and more against built-in security and compliance policies, and can also run package/image SCA checks.

Who it is for: DevOps, platform, and cloud engineers who review pull requests that change ingress, IAM, storage, or container definitions — especially relevant this week when edge proxies and “convenient” serve/MCP defaults fail open.

Why this week: Different category from last week’s TruffleHog (secrets) and the prior OSV-Scanner (advisory SCA) / gosec (Go SAST) picks. Traefik/rclone/MCP issues are often deployed via compose, Helm, or Terraform; catching 0.0.0.0 binds, missing auth env, and open security groups in code review is cheaper than incident response. PyPI latest observed at research time: 3.3.19 (active maintenance; requires Python ≥ 3.9).

Install (authorized machine only, pick one):

# pip (prefer a venv)
python3 -m venv .venv-checkov
source .venv-checkov/bin/activate
pip install -U "checkov==3.3.19"

# macOS / Linux Homebrew
brew install checkov

# Docker
docker pull bridgecrew/checkov

Safe basic example — scan only IaC you own or are authorized to review:

# From the root of YOUR authorized infra repo
checkov --directory .

# Or a single file
checkov --file path/to/your-ingress.tf

# Docker against a mounted authorized tree
docker run --tty --rm \
  --volume "$PWD":/tf --workdir /tf \
  bridgecrew/checkov --directory /tf

How to read results: Start with FAILED checks on internet-facing resources (ingress, load balancers, security groups, public buckets, container ports/hostNetwork). Each finding includes a check ID (for example CKV_*), resource address, and often a remediation guide link. Suppress only with documented risk acceptance — prefer fixing defaults (bind loopback, require auth env, drop capability).

Limitations: Policy packs are opinionated; not every FAIL is exploitable in your threat model. Checkov does not replace runtime detection, dependency CVE feeds, or penetration tests. Pin the Checkov version in CI. Do not point scans at third-party infrastructure or repositories without authorization. Some advanced features integrate with commercial Prisma Cloud services — the core CLI scanner remains usable offline for local trees.

Links: Repository · PyPI · Docs / Getting Started

💡 Security Tip of the Day

Today’s tip: For every MCP (or “AI tool”) server in your environment, record transport mode, listen address, authentication, and credential material on one page — then ensure SSE/HTTP modes are loopback-only or reverse-proxied with auth, never a naked 0.0.0.0 publish.

Why it matters: This week’s MySQL MCP and mcp-gitlab advisories show the same pattern: powerful tools + default remote transports + missing Origin/Host/auth checks = database or PAT compromise without exploiting the LLM itself.

How to apply it (≈10–15 minutes):

1. List running MCP processes/containers (docker ps, compose files, desktop agent configs).
2. For each entry note: stdio vs SSE vs Streamable HTTP; published ports; env flags (SSE=true, MCP_TRANSPORT, REMOTE_AUTHORIZATION, PATs, DB URLs).
3. Change publishes to 127.0.0.1:port:port (or remove host ports); prefer stdio for local agents; patch versions to current floors.
4. Rotate any PAT/DB password that sat behind an exposed transport.

Verify: From another host on the LAN (or a non-local namespace), the MCP port does not accept TCP. Locally, unauthenticated HTTP clients cannot call tools. Credentials used during the exposure window have been rotated.

✅ Security Actions for This Week

1. Emergency: Upgrade Traefik → ≥ 3.7.13 or ≥ 2.11.57; confirm HTTP/3 and NTLM/Negotiate backend combinations; review path-based auth assumptions after rootless-target and h2c issues.
2. Emergency: Upgrade rclone → ≥ 1.75.1 on all serve / RC serve hosts; rotate backend credentials if S3 auth-proxy was exposed without --auth-key.
3. Emergency/High: Patch MCP stacks — mysql-mcp-server ≥ 0.4.2, @zereight/mcp-gitlab ≥ 2.1.30; unpublish SSE from non-loopback interfaces; rotate PATs/DB secrets.
4. High: Upgrade Prowler Cloud ≥ 5.30.3, ZITADEL ≥ 4.15.3, http4s Ember ≥ 0.23.35 (or 1.0.0-M47), and review Central Dogma ≥ 0.84.0 / Open WebUI ≥ 0.11.1 / ESPHome device-builder ≥ 1.0.12 where deployed.
5. Hygiene: Run Checkov on one authorized infra repo (checkov --directory .); apply the MCP transport inventory tip; finish any remaining patches from the 2026-09-10 forge/framework wave.

Sources

• GHSA-qqjf-53cj-pwvv — CVE-2026-88007 Traefik HTTP/3 NTLM connection reuse
• GHSA-f52w-8j3h-j724 — CVE-2026-88009 Traefik rootless request-target bypass
• GHSA-w4v4-9rw7-5326 — CVE-2026-88008 Traefik h2c upgrade smuggling
• GHSA-v67p-phpq-fc8x — CVE-2026-88004 Traefik trailer header sanitization bypass
• Traefik v3.7.13 release
• Traefik v2.11.57 release
• GHSA-xwwr-4h3p-r22c — CVE-2026-88018 rclone serve s3 SigV4 bypass
• GHSA-p569-5gjg-9cmj — CVE-2026-88044 rclone RC auth-proxy bypass
• GHSA-c476-6w5q-jw77 — CVE-2026-88017 rclone FTP auth-proxy session confusion
• rclone v1.75.1 release
• GHSA-rqfv-2mw9-78g2 — CVE-2026-59971 MySQL MCP Server SSE unauth SQL
• mysql-mcp-server v0.4.2 release
• GHSA-cv3r-c5h8-f4g5 — CVE-2026-61560 mcp-gitlab unauth file read
• GHSA-2h44-8472-frjj — CVE-2026-61559 mcp-gitlab SSRF
• GHSA-vmp7-252j-cwp7 — CVE-2026-61568 mcp-gitlab DNS rebinding
• GHSA-5648-rgj9-v224 — mcp-gitlab safety-control bypasses
• mcp-gitlab v2.1.27 release
• mcp-gitlab v2.1.30 release
• GHSA-h8m9-jgf8-vwvp — CVE-2026-59151 Prowler SAML cross-tenant ATO
• Prowler 5.30.3 release
• GHSA-vrh8-c9cm-wh8v — CVE-2026-56668 ZITADEL token exchange
• ZITADEL v4.15.3 release
• GHSA-8h4c-x2wg-6xp8 — CVE-2026-69204 http4s Ember CL.TE smuggling
• GHSA-9998-894r-fwvr — CVE-2026-69205 http4s Ember TE parsing
• http4s v0.23.35 release
• GHSA-2j95-gqxf-v3vg — CVE-2026-11746 Central Dogma hard-coded ZK secret
• GHSA-wpmr-8h3q-fwj7 — CVE-2026-87016 Open WebUI OAuth subject wildcard
• Open WebUI v0.11.1 release
• GHSA-rrxg-g2pf-6hh4 — CVE-2026-59178 ESPHome Device Builder auth env rename
• GHSA-5h8j-6crg-7rmw — CVE-2025-59953 lmdeploy pickle RCE (fix floor published in-window)
• Checkov repository
• Checkov on PyPI
• NVD — CVE-2026-88007
• NVD — CVE-2026-88018
• NVD — CVE-2026-59971
• NVD — CVE-2026-61560
• NVD — CVE-2026-59151
• NVD — CVE-2026-56668