v vanemmerik.ai / SUPPLY-CHAIN
vanemmerik.ai / supply-chain / 2026-08-20
Supply Chain · Watch Thursday · 20 August 2026 End-of-day synthesis 4 watches · 30 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A compromised crates.io maintainer account slipped a build-time payload into three widely used Rust crates — the same postinstall-dropper playbook that's hit npm repeatedly this year, now proven out in Cargo.

Rust's turn: a hijacked crates.io maintainer account published malicious releases of arrayref, internment, and append-only-vec that pull in a typosquatted proc-macro1 package whose build script fetches and runs a cross-platform payload during `cargo build` — the same postinstall-dropper shape that's hit npm repeatedly this year, now proven out in Cargo. Socket, Aikido, BleepingComputer, and The Hacker News all corroborate independently, and the Rust Project has already pulled the malicious versions from crates.io.

Elsewhere the day skewed toward auth and injection bugs rather than more poisoning: CISA added two chained TrueConf Server bugs to KEV, where a missing-auth flaw reaches a code-injection sandbox breakout for host RCE. A fresh GHSA critical also shows Qinglong's fix for CVE-2026-3965 was incomplete — an unauthenticated path still resets admin credentials — and a pre-auth OS command injection in Laravel Backpack CRUD's Host-header handling landed alongside real, if less dramatic, holes in Fleet, Winter CMS, and NocoBase. The one bright spot: every major outlet had the Rust story within hours of each other with matching technical detail, evidence the ecosystem's detection tooling is actually working.

→ Operational priority for the night run `cargo tree -i arrayref -i internment -i append-only-vec` across every repo that touches Cargo, and treat any build since ~11:30 UTC today as compromised until you've confirmed the dependency isn't there.

21:00 ET · Last Watch
Medium · GHSA · medium · Mailpit (2-advisory batch) ·added 21:00 ET

Mailpit: WebSocket origin-check regression re-opens cross-site mail sniffing, plus an SMTP DATA-line size gap

CVE-2026-67448 is a regression of an already-patched Mailpit bug: the origin check on the /api/events WebSocket was rewritten to test the raw request URI, but Go's ServeMux routes on the percent-decoded path, so /%61pi/events reaches the handler while skipping the only origin control — any website a developer has open can silently stream live message metadata and bodies out of a local Mailpit instance. CVE-2026-67447 is a narrower companion in the same release: the SMTP DATA reader buffers a full line before checking MaxMessageSize, so one oversized line still gets allocated before the 552 rejection fires. Both affect default, no-auth Mailpit setups (1.29.0–1.30.5) — if you run Mailpit for local/CI SMTP testing, upgrade past 1.30.5 and don't rely on --ui-auth-file alone as your only mitigation for the origin bypass.

18:00 ET · First Watch
Critical · CISA KEV · added 2026-08-20 · TrueConf Server (2-CVE batch) ·added 18:00 ET

CISA KEV adds two TrueConf Server bugs — missing auth plus code injection chain to host RCE

CISA added two TrueConf Server vulnerabilities to KEV today: CVE-2026-72529 lets an unauthenticated remote attacker on port 4307/TCP execute an arbitrary script with no auth check, and CVE-2026-72530 lets that same script break out of its isolated environment to run arbitrary code on the host. Chained, that's unauthenticated remote code execution on the underlying server, and the missing-auth half carries a 3-day BOD 26-04 remediation window (due 2026-08-23) versus 14 days for the breakout — CISA is treating it as the more urgent half. Patch per TrueConf's advisory now if you run Server on port 4307 anywhere internet-reachable; don't wait for the 2026-09-03 due date on the second CVE.

Critical · GHSA · critical · Qinglong (whyour/qinglong) ·added 18:00 ET

Qinglong: incomplete auth-bypass fix still allows unauthenticated admin credential reset

The original fix for CVE-2026-3965 only guarded `/api/user/init`, but Qinglong's init endpoint is also reachable at `/open/user/init` — a path that's whitelisted out of JWT auth and gets internally rewritten to `/api/user/init` after the auth guard has already passed. Any already-initialized Qinglong panel is still exploitable for an unauthenticated admin credential reset via that second path, full takeover of the automation panel. Upgrade past commit 6bec52dca158; if you can't patch today, block `/open/user/init` at the reverse proxy.

High · GHSA · high · Fleet ·added 18:00 ET

Fleet: SQL injection in Okta conditional-access endpoint lets a single enrolled host compromise the whole database

An unauthenticated request path supporting Fleet Premium's Okta conditional-access integration builds a database query from a host-supplied value with no sanitization — a host that's merely enrolled, not an admin, can read or write arbitrary rows including stored session tokens. Replay one of those tokens and you're a global administrator, which on a managed fleet is remote code execution on every enrolled endpoint. Patch immediately if Okta conditional access is configured; this is agent-adjacent infrastructure with a direct line to RCE on every device it manages.

High · GHSA · high · Winter CMS ·added 18:00 ET

Winter CMS: authenticated Twig sandbox escape bypasses last year's fix (CVE-2024-54149), reaches RCE

Backend users with CMS template-editing permissions (manage_pages, manage_layouts, manage_partials) can escape Winter's Twig sandbox entirely — arbitrary SQL including DDL, admin credential exfiltration, and PHP injection into pages, layouts, or partials for full RCE. This is a bypass of a sandbox fix from 2024, so treat 'sandboxed template engine' as an ongoing audit item rather than a closed ticket. Patch now, and review what your template-editing permissions actually allow if you grant them to lower-trust editors.

High · GHSA · high · NocoBase ·added 18:00 ET

NocoBase: authenticated admin chains arbitrary file write with LFI to reach RCE

Any authenticated admin can redirect NocoBase's upload storage root to an arbitrary filesystem path — including the application directory — via an unsanitized `documentRoot` on the storages:update API, then trigger Node's `require()` on any absolute path through the plugin manager's pm:enable endpoint. Chained, that's an admin-privileged write-then-require RCE primitive, the same file-write-plus-LFI shape that's shown up in other low-code/no-code platforms this year. Patch, and audit who holds the admin role if NocoBase sits anywhere multi-tenant.

High · GHSA · high · Pipelines-as-Code ·added 18:00 ET

Pipelines-as-Code: GitHub App credentials exfiltrated via spoofed Enterprise-Host header before signature validation

Affected versions trusted the `X-GitHub-Enterprise-Host` request header to pick the GitHub Enterprise API host during App token generation, and did it before validating the webhook signature or checking the Enterprise host against the signed payload's repo URL — so a forged webhook request can redirect the App's installation-token request to an attacker-controlled host and capture the token. Anyone running Pipelines-as-Code with the GitHub App provider should rotate the App's private key after patching, not just update.

High · GHSA · high · Laravel Backpack CRUD (4-advisory batch) ·added 18:00 ET

Laravel Backpack CRUD: pre-auth OS command injection via Host header, plus a cross-tenant IDOR, arbitrary file deletion, and unverified password change

The one to patch first: `Stats::makeCurlRequest` shells out with an unescaped, attacker-controlled Host header on every request when exec()/curl are available — gated by only a 1-in-100 random check that an attacker just retries past — giving pre-auth OS command execution as the web user. The other three are authenticated-but-still-bad: Update/Delete/Reorder operations skip the tenant-isolation query scopes that list/read enforce (cross-tenant IDOR by primary-key guessing), `clear_<attr>[]` deletes arbitrary disk paths with no ownership check, and the account-info form mass-assigns `password` because it reads `except(['_token'])` instead of the validated field list. Upgrade now — the Host-header RCE needs no authentication at all.

High · GHSA · high · Wagtail ·added 18:00 ET

Wagtail: reflected XSS in the dynamic image URL generator hits every install, even with the feature disabled

A limited-permission editor can craft a URL against Wagtail's dynamic image URL generator view that executes script in a higher-privileged admin's session when viewed — and the vulnerable code path exists on every Wagtail site regardless of whether the dynamic image serve view is actually enabled. Not exploitable by an anonymous site visitor, but any CMS with tiered editor permissions should patch rather than assume the feature-off default protects them.

High · GHSA · high · netty-incubator-codec-ohttp (5-advisory batch) ·added 18:00 ET

netty-incubator-codec-ohttp: private-key exposure in logs, two DoS loops, a memory leak, and an OOM buffer

Five disclosures land at once in this Oblivious HTTP codec: BoringSSL HPKE private-key bytes leak into toString() and exception messages (8.1 — fix first if you log key objects), two separate infinite-loop bugs in BinaryHttpParser let a remote peer pin a decoding thread forever with a tiny malformed request, a missing length limit on variable-length fields lets a peer force unbounded buffering to OOM, and a failed AEAD tag check leaks a native direct-memory buffer on every failed decryption. This is pre-1.0 incubator code — confirm whether you're actually running it in anything production-facing before treating this as urgent, but if you are, all five need the same patch cycle.

12:00 ET · Forenoon Watch
Critical · Socket · active campaign · crates.io (corroborated by Aikido, BleepingComputer, The Hacker News) ·added 12:00 ET

Rust crates arrayref, internment, and append-only-vec compromised via hijacked maintainer account, pull in malicious proc-macro1 dependency that fetches a build-time payload

Confirmed maintainer-account compromise on crates.io: the attacker published malicious releases of arrayref, internment, and append-only-vec that add a dependency on a typosquatted proc-macro1 package whose build script downloads and executes a cross-platform payload during `cargo build` — before any of your code runs. The Rust Project has since pulled the malicious versions from crates.io, and Socket, Aikido, and BleepingComputer independently confirm the same TTP: a postinstall-style dropper hidden in a build script, the Cargo equivalent of this year's recurring npm pattern. Run `cargo tree -i arrayref -i internment -i append-only-vec` across every repo, check for a proc-macro1 dependency, and treat any CI build since ~11:30 UTC today as potentially compromised — rotate credentials on affected runners.

High · GHSA · high · logto-tunnel ·added 12:00 ET

logto-tunnel: --experience-path directory escape via unsanitized request URL

logto-tunnel's static file proxy builds the filesystem path by joining the configured experience directory with the raw request URL, so a `../` segment in the request reads files outside that directory that the tunnel process can access. Anyone running `logto-tunnel` to preview custom sign-in experiences is exposing local file read to whoever can reach the tunnel port. Update, and don't expose the tunnel port beyond localhost until you do.

High · GHSA · high · Grav ·added 12:00 ET

Grav: .htaccess sensitive-extension block bypassed by case variation on case-insensitive filesystems

Grav's shipped .htaccess blocks direct HTTP access to .yaml, .php, .json, and .twig under user/ and system/vendor/, but the rules lack the [NC] case-insensitive flag, so requesting the same file as .YAML or .PHP sails past the block on Windows, macOS, or any Linux host with a Docker volume mounted from one of those. It's a config-hardening gap that only bites on cross-platform deployments — a lot of local-dev-on-Mac, prod-on-Linux setups fit that description. Add [NC] to the extension rules yourself if you can't wait for an upstream release.

High · GHSA · high · XWiki Platform ·added 12:00 ET

XWiki: Live Data Live Table Connector lets any editor escalate to script right

XWiki's Live Data edit REST API doesn't fully enforce rights checks, so any user who can edit a page can use it to grant themselves script right on that page — unlocking arbitrary Velocity execution and unfiltered HTML/JS to viewers. It also bypasses extension-level authorization implemented as listeners on the standard User… events, so the blast radius includes third-party security plugins that assumed those checks held. Upgrade to 16.10.17 / 17.4.10 / 17.10.4 / 18.1.0 — there's no workaround.

High · GHSA · high · Document Merge Service ·added 12:00 ET

Document Merge Service: RCE via SSTI in XLSX template processing

adfinis/document-merge-service runs XLSX templates through the xltpl library's non-sandboxed Jinja environment, so a malicious template achieves remote code execution as the service's own container user. It's the same unsandboxed-template-engine shape as today's GeoServer FreeMarker item — anywhere user-supplied templates hit a general-purpose templating engine without a sandbox is worth auditing this week. Upgrade to v9.1.0, or disable XLSX template upload until you do.

High · GHSA · high · Contentful MCP Server ·added 12:00 ET

Contentful MCP Server: export_space/import_space host/proxy redirect, re-surfaced from yesterday's disclosure

Same Contentful MCP PAT-redirect issue flagged yesterday — export_space/import_space still pass LLM-controlled host/proxy values straight to the CMA SDK, which attaches the server's Personal Access Token as a bearer header to whatever host that is. Re-surfaced in today's fetch window with no new detail; if you haven't rotated the PAT and pinned an upstream fix, today is the second reminder.

High · GHSA · high · Copier ·added 12:00 ET

Copier: trust-prefix check bypassed via path traversal, runs template tasks without the --trust prompt

Copier's `trust` setting compares a template URL against a trusted prefix with a raw `startswith`, but the URL gets normalized later when it's actually fetched — so a reference like `https://github.com/trusted-org/../attacker-org/repo.git` passes the trust check as text but resolves to an attacker's template at fetch time, whose tasks/migrations/jinja_extensions then execute without ever prompting for `--trust`. Anyone scaffolding projects from a Copier template pinned by prefix rather than exact URL is exposed to silent code execution. Upgrade past 9.15.1 and pin templates by exact URL, not prefix, in the meantime.

High · GHSA · high · claude-faf-mcp / faf-mcp / grok-faf-mcp (3-advisory batch) ·added 12:00 ET

claude-faf-mcp, faf-mcp, and grok-faf-mcp: unconfined path argument gives arbitrary local file read (write on two of the three)

Three sibling FAF-tooling MCP servers share the same bug: the `path` argument feeding `getProjectPath()` and the `faf_read`/`faf_write` tools resolves `~` and `../` with no confinement to the project directory, so an absolute path or traversal reaches files anywhere the server process can read — home-directory secrets included — and on claude-faf-mcp/faf-mcp, write there too. MCP tool arguments can be LLM-controlled, so prompt injection from a web page or repo the model reads is a realistic trigger path, not just a hostile direct caller. Update all three packages; until then, don't point any of them at a directory containing anything you wouldn't want read or overwritten.

Medium · GHSA · medium · Tina CMS (2-advisory batch) ·added 12:00 ET

Tina: cross-origin dev-server file write, plus arbitrary S3 bucket-key write/delete in production media adapters

Two Tina disclosures: the local dev server's CORS middleware rejects disallowed origins client-side only, so an attacker page can still POST a multipart request that writes arbitrary files into a developer's media directory without ever reading the response; separately, next-tinacms-s3's media handler takes a caller-supplied `key` query parameter and signs a PutObject/DeleteObject for it with no check against the configured `mediaRoot`, giving any authorized CMS editor bucket-wide write and delete. The dev-server bug needs a developer to browse a malicious page while `tinacms dev` is running; the production bug is exploitable by any legitimate low-trust editor, so fix that one first. Patch, and don't rely on the SDK to scope the IAM key to mediaRoot for you.

Medium · GHSA · medium · SearXNG MCP Server (2-advisory batch) ·added 12:00 ET

SearXNG MCP Server: hardened-mode SSRF guard off by default, plus redirect/canonicalization bypasses when it's on

Two more SearXNG MCP disclosures on top of today's earlier credential-leak item: the `web_url_read` tool's internal-address guard only runs when `MCP_HTTP_HARDEN=true`, which is off by default, so a stock install has no SSRF filtering at all; and even with hardening enabled, redirects to loopback/internal targets aren't re-validated, `0.0.0.0` isn't treated as internal, and IPv4-mapped IPv6 literals slip past canonicalization. Three SearXNG disclosures in one fetch window is a pattern — audit any MCP server that fetches attacker-influenced URLs server-side. Set MCP_HTTP_HARDEN=true today; per the bypasses above, that's necessary but not sufficient.

06:00 ET · Morning Watch
High · GHSA · high · Snipe-IT (3-advisory batch) ·added 06:00 ET

Snipe-IT: chained IDOR takes over EULA files, plus a maintenance-record leak and stored XSS

Three Snipe-IT disclosures: a chained information-disclosure-plus-IDOR bug lets a low-privileged user fully overwrite another organization's EULA document, a missing authorization check on a GET endpoint leaks maintenance records to any authenticated user, and a stored DOM XSS sits in the asset table's selected-count IDs. The EULA takeover is the one to patch first — for an IT asset-management system of record, that's a document-integrity issue as much as a security one. Upgrade to the patched release and audit EULA files for unexpected changes.

High · GHSA · high · GeoLens (10-finding batch, fixed 1.2.4) ·added 06:00 ET

GeoLens 1.2.4: SSRF-via-DNS-rebinding to internal/metadata addresses, plus a token leak through /proc/pid/environ

GeoLens's second disclosure in two days (yesterday's authz batch fixed in 1.2.3; this one lands in 1.2.4) adds an SSRF where URL validation resolves DNS once but the HTTP client re-resolves at connect time, so a low-TTL domain passes validation as public and then rebinds to an internal or cloud-metadata address. It also leaks the service-preview auth token through GDAL's process environment (`/proc/<pid>/environ`) with CRLF header injection alongside it, plus shared-cache poisoning that lets a CDN replay private tile bytes to unauthenticated requests. If you run GeoLens in a cloud VPC, treat the SSRF as a path to IMDS credentials — yesterday's authz patch is not sufficient, upgrade to 1.2.4.

High · GHSA · high · MCP PHP SDK ·added 06:00 ET

MCP PHP SDK: unbounded SSE buffer growth lets a malicious MCP server exhaust client memory

The PHP SDK's HTTP transport appends every SSE chunk to an in-memory buffer (`sseBuffer .= chunk`) with no size cap, so a malicious or compromised MCP server can withhold the event terminator and stream data indefinitely to OOM-kill the client process. It's the inverse of yesterday's MCP-ecosystem batch — instead of a malicious client or prompt attacking a server, a malicious server attacks the client that trusts it. Cap response size at the transport layer before connecting PHP-based MCP clients to third-party or unvetted servers.

Medium · GHSA · low+medium · moby/buildkit (2-advisory batch) ·added 06:00 ET

BuildKit: unbounded group-parsing DoS, plus a custom frontend can bypass Seccomp/AppArmor confinement

Two BuildKit disclosures: a build step can supply crafted `/etc/group` content that BuildKit parses without bounds, exhausting daemon memory, and separately a custom frontend can override the container's Seccomp profile or disable AppArmor entirely for steps that should be sandboxed. The Seccomp/AppArmor bypass is the one that matters — any CI pipeline that lets tenants choose their own frontend image is handing them the keys to the sandbox. Pin frontend images and don't let untrusted build definitions select their own frontend.

Medium · GHSA · medium · SearXNG MCP Server ·added 06:00 ET

SearXNG MCP Server: Basic Auth credentials leak into logs and JSON-RPC error responses

The SearXNG MCP server logs its configured HTTP Basic Auth credential in plaintext and echoes it back in JSON-RPC error bodies when a backend request fails, so anyone with log access or a triggered error sees the instance's auth secret. It's the same MCP-server-as-credential-leak shape as yesterday's Contentful PAT redirect, just via logging instead of an LLM-controlled parameter. Rotate the Basic Auth credential and scrub historical logs on any affected build.

Medium · GHSA · medium · uprobe gadgets ·added 06:00 ET

Uprobe gadgets: unprivileged container startup DoS via ld.so.cache parsing

A container running an unprivileged uprobe gadget can trigger high CPU utilization at startup from how the dynamic linker's `ld.so.cache` is parsed under uprobe instrumentation — effectively a DoS against container boot time. Blast radius is narrow, it needs the specific gadget configuration, but worth checking if you run eBPF-based uprobe tooling in unprivileged mode on shared nodes.

Medium · GHSA · medium · block_buffer ·added 06:00 ET

block_buffer: crafted input corrupts the inline buffer position, causing a panic

The block_buffer crate's stack-allocated inline buffer can have its position field corrupted by crafted input, producing a panic rather than memory corruption in the reported cases. If it's a transitive dependency through a hashing or streaming crate, an attacker-triggerable panic on untrusted input is still a DoS for any service that doesn't catch the unwind. Check `cargo tree` for block_buffer and update once a patched release lands.

Medium · GHSA · medium · langgraph-api (2-advisory batch) ·added 06:00 ET

LangGraph Server: incomplete assistant authorization on run creation, plus relative webhook targets reach in-process routes

Two langgraph-api disclosures: run creation doesn't fully verify the caller is authorized for the target assistant, so a user who can reach the API may start runs against assistants they shouldn't touch; separately, webhook URLs given as relative paths get resolved against the server's own base URL, letting a crafted webhook target reach in-process routes without normal authentication. Both are authorization-boundary bugs in agent-orchestration infrastructure, continuing the theme from yesterday's MCP disclosures. Patch, and if you accept user-supplied webhook URLs, require absolute URLs with an explicit allowlist.

Context · BleepingComputer ·added 06:00 ET

New "Manic" Android malware relays exfiltrated data through nearby infected devices when offline

Manic is a new Android data-stealing malware targeting users across multiple European countries; when an infected device has no network connectivity, it falls back to relaying stolen data to nearby infected devices over local radio, which forward it once one of them regains connectivity. Not a software-supply-chain vector directly, but the device-mesh relay is a notable evasion technique for anyone building mobile threat detection around network-egress monitoring alone.