Supply Chain · Watch Thursday · 27 August 2026 End-of-day synthesis 4 watches · 11 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Today's fault lines run through the machinery meant to guarantee package integrity — a signature-verification bypass in Crossplane and a path-traversal KEV add in JFrog Artifactory — even as Australian police close the book on March's scanner-compromise campaign.

CISA closed out a quiet ingest day with three fresh KEV catalog adds inside six hours, and GHSA served up a same-day signature-verification bypass in Crossplane's OCI package client — the exact machinery supply-chain defenses are supposed to depend on.

Crossplane's xpkg.CachedClient resolves an image tag once for cosign verification and again for the actual pull, so a malicious registry can hand a signed image to the verifier and an unsigned one to the installer (GHSA-mf7q-r4rv-jv94) — treat any tag-based Crossplane install from an untrusted registry as unverified until 2.3.3/2.2.3 ship. JFrog Artifactory's new KEV entry (CVE-2026-66384) is the mirror image on the registry side: an authenticated user can write outside the intended Docker cache path, meaning the artifact store itself can be steered into serving tampered cache content. Three Silverstripe CMS advisories, two of them email-template RCEs, round out a heavier-than-usual GHSA batch, but none carry the active-exploitation signal the KEV adds do — and the bright spot is that Australian Federal Police charged two men over TeamPCP, the group blamed for March's Trivy, Checkmarx KICS, and LiteLLM compromises, a rare case where this year's open-source tooling attacks get an attribution instead of just a vendor post-mortem.

→ Operational priority for the night pin any Crossplane package installs from untrusted registries to digests instead of tags, and check JFrog Artifactory instances against CVE-2026-66384 ahead of the September 10 KEV due date.

21:00 ET · Last Watch

Medium · GHSA ·added 21:00 ET

WebOb's third patch attempt still leaves an open redirect in Location-header normalization

WebOb's guard against open redirects checks a Location value for a URI scheme or leading "//" before calling urljoin() to make it absolute — but Python 3.10+'s urljoin() also strips leading C0 control characters and spaces, so a single leading space (" //evil.example") slips past the un-stripped check and comes out the other side as a protocol-relative or fully absolute attacker URL. This is the third CVE against the same code path (CVE-2024-42353 → CVE-2026-44889 → CVE-2026-54770), each fix patching the previous fix's blind spot rather than the underlying normalization mismatch. Upgrade past 1.8.11; if you're patching similar redirect-sanitization logic elsewhere, test against leading whitespace/control-byte smuggling, not just tab/CR/LF.

Medium · GHSA ·added 21:00 ET

aiosmtplib STARTTLS response injection lets a MITM desync the post-handshake session

aiosmtplib through 5.1.1 reuses the same plaintext receive buffer across the STARTTLS handshake, so an active MITM can pipe attacker-chosen response lines behind the server's 220 go-ahead and have them parsed as if they'd arrived inside the TLS session — a classic STARTTLS command-injection shape that's bitten mail libraries for over a decade. Implicit TLS (use_tls=True) has no plaintext phase and isn't affected; this only matters if you're using start_tls=True/None over a network path an attacker can intercept. Patch to 5.1.2, or switch to implicit TLS if you can't upgrade immediately.

18:00 ET · First Watch

Critical · CISA KEV ·added 18:00 ET

CISA KEV: JFrog Artifactory path traversal writes outside the intended Docker cache path (CVE-2026-66384)

CISA added CVE-2026-66384 to the KEV catalog: an authenticated Artifactory user can write outside the intended Docker cache path under specific remote-repository configurations. That's a path-traversal bug in the artifact store itself — the system your org depends on to guarantee what gets pulled into CI is what you actually built — not a downstream package. Patch ahead of the September 10 due date and check whether any remote Docker repositories use the affected caching mode.

Critical · CISA KEV ·added 18:00 ET

CISA KEV: ownCloud improper-authentication bug re-flagged, three-year-old CVE gets a due date (CVE-2023-49105)

CISA re-flagged CVE-2023-49105, a 2023 ownCloud bug: an attacker who knows a victim's username can access, modify, or delete any file with no signing key configured and no authentication required. It's an old disclosure getting new operational urgency — the KEV due date is August 30, three days out. If any ownCloud instance is running without a signing key configured, that's the fix; otherwise confirm you're already patched.

Critical · CISA KEV ·added 18:00 ET

CISA KEV: Linux kernel IPv6 privilege-escalation bug added, details still unspecified (CVE-2026-53362)

CISA also added CVE-2026-53362, a privilege-escalation bug in the Linux kernel's IPv6 networking subsystem affecting SUSE, Red Hat, and other kernel-based distros. CISA's own writeup just says "unspecified" — no technical detail yet — but a KEV add means someone is actively using it. Prioritize kernel patching on internet-facing or multi-tenant hosts ahead of the August 30 due date.

High · GHSA ·added 18:00 ET

Crossplane TOCTOU lets a malicious OCI registry bypass cosign signature verification on tag-based package installs

Crossplane's xpkg.CachedClient resolves a tag reference once for cosign signature verification and again for the actual image pull; a malicious registry can serve a correctly-signed image to the first call and an unsigned one to the second (GHSA-mf7q-r4rv-jv94). This only bites if you've configured signature verification, install packages by tag, and pull from a registry you don't control — but that's exactly the threat model signature verification exists to close. Switch to digest-pinned installs now; the real fix lands in v2.3.3 and v2.2.3.

High · GHSA ·added 18:00 ET

Silverstripe ships three same-day advisories: two email-template RCEs and a CMS media-embed XSS

Silverstripe patched three same-day advisories: RCE via the advancedworkflow email template (CVE-2026-54718, GHSA-39mm-rwm3-29jp), RCE via the userforms email subject field (CVE-2026-54721, CVSS 8.8, GHSA-g8wr-r2v2-vqc6), and stored XSS through CMS media embeds (CVE-2026-54720, GHSA-gvrw-qqp5-jgc5). All three are the same shape — CMS-admin-controlled template/input fields rendered without sufficient sanitization. Patch to advancedworkflow 6.4.5+/7.1.3+, userforms 6.4.9+/7.0.7+/7.1.1+, and framework 6.2.2+.

Medium · GHSA ·added 18:00 ET

libreoffice-convert (npm) path traversal allows arbitrary file write via unsanitized fileName

libreoffice-convert builds a temp-file path directly from a caller-supplied fileName without reducing it to a basename, so a "../" payload writes an attacker-controlled document anywhere the Node process can write — authorized_keys, cron.d, a web root. Fixed in 1.8.2 via path.basename(); if you can't upgrade immediately, sanitize fileName yourself before it reaches the library.

Medium · GHSA ·added 18:00 ET

n8n-nodes-sqlite3 path traversal via workflow-controlled db_path parameter

Pre-1.0.0 versions of the n8n SQLite node take the database file path as a plain workflow parameter, so a workflow author who wires untrusted input into db_path lets an attacker pick which file SQLite opens — path traversal to read or overwrite arbitrary files. Only bites multi-tenant or user-facing n8n deployments where workflow authors aren't fully trusted; 1.0.0 moves the path into a server-side credential. Audit existing workflows for db_path bound to user input and upgrade.

12:00 ET · Forenoon Watch

High · The Hacker News ·added 12:00 ET

Amazon Kiro prompt injection exfiltrates workspace data via Kiro Powers — another MCP trust-boundary failure

Mindguard disclosed a prompt-injection flaw in Amazon's agentic IDE Kiro, tested against 0.7.45 on Windows (no CVE assigned; current release is 1.0.337 and the writeup doesn't confirm whether it's fixed), where attacker-controlled repository content in a workspace file is interpreted as agent instructions and can exfiltrate local sensitive data to an external endpoint — the user never has to write or reference a malicious prompt, just open the crafted workspace via File → Open Workspace From File and send any message. It's the same MCP/steering-file trust-boundary failure this watch has been tracking in other agentic tools: Kiro Powers bundles MCP server configs, POWER.md steering files, and hooks, and none of that separates untrusted repo content from executable instructions. Treat unfamiliar Kiro workspaces as hostile until Amazon confirms a fix version — avoid the workspace-file open path, and audit any MCP tool configs a repo tries to auto-register.

Context · BleepingComputer ·added 12:00 ET

Australia charges two alleged TeamPCP members over the March 2026 Trivy / Checkmarx KICS / LiteLLM compromises

The Australian Federal Police charged two Western Australian men, 23 and 21, with 14 offences combined over their alleged role in TeamPCP, the group blamed for the March 2026 compromise of the open-source scanners Trivy and Checkmarx KICS and the LiteLLM AI gateway. No new technical detail on the intrusions themselves, but it closes the loop on three of this year's higher-profile scanner/gateway compromises with a law-enforcement attribution rather than just vendor post-mortems. Worth a look if you're still doing incident cleanup from those March compromises — the case filings may surface additional IOCs as it proceeds.