v vanemmerik.ai / SUPPLY-CHAIN
vanemmerik.ai / supply-chain / 2026-08-13
Supply Chain · Watch Thursday · 13 August 2026 End-of-day synthesis 2 watches · 16 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — The AI-agent stack disclosed four unrelated bugs in one day, and a backfilled Metabase KEV entry hits its federal patch deadline tomorrow.

Today's GHSA batch skewed unusually toward the AI-agent tooling stack: Trigger.dev, atomic-agents-stack, Pydantic AI, and vLLM each disclosed a distinct bug — prototype pollution, a dashboard path traversal, an unvalidated file reference, and an unbounded request fan-out. None is catastrophic alone, but four unrelated frameworks hitting the same vintage of bug class in one day says this generation of agent tooling is still working through problems web frameworks solved a decade ago.

Etherpad added three separate medium disclosures of its own — a replayable token-transfer endpoint, a predictable temp-file race, and a header-reflection XSS — worth patching together rather than one at a time. Also going up tonight: three CISA KEV entries added this past Monday (a Metabase SQL injection, a Windows AFD use-after-free, and a Cisco ASA/FTD DoS) that fell through a gap in this pipeline and are backfilled two days late; none show confirmed ransomware use, which is the one piece of good news in the batch.

→ Operational priority for the night patch or isolate any internet-facing Metabase instance before tomorrow's CISA deadline, then work through the AI-framework and Etherpad disclosures in order of exposure.

20:00 ET · First Watch
Critical · CISA KEV · Metabase (added 2026-08-11) ·added 20:00 ET

CISA KEV adds Metabase unauthenticated SQL injection — full admin takeover of the BI layer (CVE-2026-72898)

Metabase's newly-catalogued KEV entry: an unauthenticated SQL injection into the application database that CISA confirms is being exploited to reach full admin access on the instance. From there an attacker rewrites app config, pulls stored credentials for every connected database, and exports whatever those connections can see — a single Metabase box becomes a skeleton key for the BI layer. Federal due date is 2026-08-14 — tomorrow — so patch or take internet-facing instances offline tonight.

Critical · CISA KEV · Microsoft Windows AFD for WinSock (added 2026-08-11) ·added 20:00 ET

CISA KEV adds Windows Ancillary Function Driver for WinSock use-after-free — confirmed exploited local privilege escalation (CVE-2026-68820)

A use-after-free in the Windows Ancillary Function Driver for WinSock now carries a CISA KEV entry for local privilege escalation, confirmed exploited. It's a kernel-driver bug in the networking stack every Windows host loads, so any authenticated foothold — including one from an unrelated compromise — becomes SYSTEM. Prioritize patching internet-facing and shared-tenant Windows hosts; due date is 2026-08-25.

Critical · CISA KEV · Cisco Secure Firewall ASA/FTD (added 2026-08-11) ·added 20:00 ET

CISA KEV adds Cisco ASA/FTD heap inspection DoS — unauthenticated remote reload (CVE-2026-20349)

Cisco Secure Firewall ASA and FTD have a heap-inspection bug that lets an unauthenticated remote attacker force an unexpected reload — a DoS against the perimeter firewall itself, now KEV-listed. Losing an ASA/FTD pair mid-incident is its own outage; patch ahead of the 2026-08-14 deadline, not after.

High · GHSA · Trigger.dev (CVSS 8.5) ·added 20:00 ET

Trigger.dev: prototype pollution via run-metadata operations causes process-wide cross-tenant DoS

Trigger.dev's run-metadata update endpoint passes a client-supplied operation.key straight into a JSONHero path setter with no __proto__/constructor guard, so a request like key: "$.__proto__.polluted" pollutes Object.prototype for the whole process — a cross-tenant DoS on any multi-tenant deployment. Patch @trigger.dev/core past 4.5.5; if anything else in your stack accepts a client-supplied key without an allow-list, audit it for the same shape.

High · GHSA · Pimcore (CVSS 8.5) ·added 20:00 ET

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

A missing trailing $ anchor in Pimcore's ClassDefinition UID validation regex — an incomplete fix that added the leading ^ but not the closing anchor — lets an authenticated user with objects permission embed raw SQL in a class UID that later gets concatenated unquoted into a query in Block.php. If you patched the original UID-validation issue and moved on, re-check: this is the second time a regex-anchor gap has been the actual bug.

High · GHSA · atomic-agents-stack ·added 20:00 ET

atomic-agents-stack: dashboard HTTP server path traversal allows arbitrary file read

The optional dashboard HTTP server in atomic-agents-stack is the one request path that skips the framework's own safe_resolve_under containment check, so literal ../ segments survive urlparse and Path joining straight into an arbitrary file read. Agent-framework auxiliary surfaces — dashboards, debug UIs — get less scrutiny than the core request path; don't expose the dashboard to untrusted networks until a patched version lands.

High · GHSA · Argo Workflows ·added 20:00 ET

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (third incomplete fix for CVE-2026-31892)

Third patch attempt at the same Argo Workflows allow-list bypass: the Strict/Secure template-reference validator walks only top-level WorkflowSpec fields via reflection, so the allow-listed ArtifactGC field's own nested struct was never checked and can carry a PodSpecPatch. If you run Argo Workflows with untrusted submitters and assumed the earlier fixes closed this, they didn't — patch to 4.0.6 / 3.7.15 and don't treat allow-list validation as transitive.

High · GHSA · ansible-jailexec ·added 20:00 ET

Ansible FreeBSD jailexec connection plugin: jail escape via symlink following in put_file (host-side root mv)

The jailexec connection plugin resolves file-transfer destinations to a host-side path and runs mkdir -p / mv as root there — both commands follow symlinks, and the resolution happens outside the jail, so anything with write access inside a managed jail can plant a symlink and have Ansible's root-privileged mv follow it out. If you manage FreeBSD jails with jailexec, treat any jail as equally trusted as the host until you're past 2.0.0.

Medium · GHSA · vLLM (CVSS 6.5) ·added 20:00 ET

vLLM: completion prompt lists fan out into unbounded engine requests

vLLM's /v1/completions endpoint accepts prompt as an unbounded list and turns every element into its own engine generator and response slot before any aggregate request-count budget applies — one authenticated call can multiply into as many backend subrequests as the list is long. Cap request-level prompt-list length at the gateway until 0.26.0 lands the fix.

Medium · GHSA · Pydantic AI (CVSS 6.8) ·added 20:00 ET

Pydantic AI: unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Pydantic AI's UI adapters reconstruct file references from client-submitted message history and forward them to the model provider unvalidated, so the provider fetches whatever file URL the client specified using the application's own credentials — the client borrows your server's access to read files it shouldn't see. Same shape as classic SSRF, laundered through a model-provider file-fetch call. Upgrade past 1.106.0 (or 2.0.0b6 on the beta line) and don't trust client-submitted file URLs in message history.

Medium · GHSA · hashi-vault-js ·added 20:00 ET

hashi-vault-js: Vault token and secret values exposed in thrown errors

Every method in hashi-vault-js throws the raw Axios error on failure, which carries the full request config — including the X-Vault-Token header — so any app that logs caught errors (console.error, pino, winston, Sentry) writes a live Vault token to its logs in plaintext. Grep your log aggregator for X-Vault-Token now; if you find hits, rotate those tokens regardless of when you patch the library.

Medium · GHSA · ep_etherpad-lite (CVSS 6.8) ·added 20:00 ET

ep_etherpad-lite: device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad's device-to-device token-transfer endpoint — the QR-code flow for moving a session to a new browser — never expires, is replayable, and returns the cleartext author token in the response body, so a leaked or intercepted transfer URL grants indefinite session takeover. Disable or firewall the /tokenTransfer endpoints if you can't upgrade immediately.

Medium · GHSA · ep_etherpad-lite (CVSS 4.2) ·added 20:00 ET

ep_etherpad-lite: import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad's import/export handlers derive temp file names from Math.random(), which is predictable within a process — on a shared /tmp, that's enough to pre-plant a symlink and have the export handler overwrite an arbitrary file. Same underlying flaw as decade-old race-condition tempfile bugs; if your instance shares /tmp with other tenants, treat this one as higher priority than its medium label suggests.

Medium · GHSA · ep_etherpad-lite (CVSS 6.1) ·added 20:00 ET

ep_etherpad-lite: cache-poisoning cross-site scripting and open redirect via x-proxy-path header

A third Etherpad disclosure the same day: the x-proxy-path header gets reflected into admin HTML/JS/CSS unsanitized, enabling cache-poisoning XSS and open redirect wherever a shared cache sits in front of the deployment. Three unrelated bug classes — auth, race condition, injection — landing on one project in one day is a good prompt to schedule the full Etherpad patch cycle now instead of triaging each CVE separately.

Medium · BleepingComputer · Open Source Ingestion ·added 20:00 ET

Who vets AI's code? The scale challenge facing open-source ingestion

BleepingComputer/ActiveState make the structural argument worth logging: AI coding assistants introduce open-source dependencies — sometimes hallucinated, always unvetted — faster than traditional security review can keep pace, and the fix has to be governance at the point of selection, not scanning after the fact. Pairs directly with today's cluster of AI-framework CVEs (Trigger.dev, atomic-agents-stack, Pydantic AI, vLLM): the frameworks themselves are young enough to still be finding basic bug classes, so whatever's pulling them in as transitive deps needs the same scrutiny as any other new dependency.