v vanemmerik.ai / SUPPLY-CHAIN
vanemmerik.ai / supply-chain / 2026-08-28
Supply Chain · Watch Friday · 28 August 2026 End-of-day synthesis 4 watches · 21 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A Shai-Hulud-style npm worm hit a widely-used TanStack Query codegen package with valid provenance attestations, Pimcore shipped five same-day advisories chaining editor access to server RCE, and a late GHSA batch added a RestrictedPython sandbox-guard bypass and a SeaweedFS bucket-isolation break.

The morning and midday passes were quiet — a handful of routine GHSA disclosures and an espionage backdoor recap — but the evening flipped the day's shape entirely.

Socket caught @7nohe/openapi-react-query-codegen compromised in a Mini Shai-Hulud-pattern npm attack: ten malicious versions published with valid provenance, meaning the attacker owned the CI pipeline rather than forging a badge, with the same credential-harvesting, self-republishing worm logic as last year's campaign. Separately, Pimcore dropped five advisories in one hour that chain together into a full kill chain — an unauthenticated password-reset hijack with 2FA bypass, plus two independent editor-to-RCE paths via unvalidated field names and an unrestricted unserialize() — against any internet-facing instance. Spinnaker's rosco service and Portainer's setup-window admin bypass round out a heavier-than-usual high-severity batch in CD and container-management tooling specifically.

Late escalation at 21:00 ET: a fresh GHSA batch landed after First Watch closed, including a sandbox-escape in RestrictedPython (argument-shadowing bypasses the guard hooks apps rely on for policy enforcement), an 8.6-CVSS XXE in MapFish Print, and a pair of SeaweedFS S3-gateway bugs that break bucket isolation via a confused-deputy copy-source bypass. None of it is an active campaign like the npm worm, but five more high-severity disclosures in one evening window is enough volume to flag before the day closes out.

→ Operational priority for the night audit every repo for @7nohe/openapi-react-query-codegen and rotate any CI tokens on hosts that installed it, patch or take internet-facing Pimcore offline before morning, and if you embed RestrictedPython for sandboxed execution, check for the positional-only-argument guard bypass before trusting it with untrusted code tonight.

21:00 ET · Last Watch
High · GHSA ·added 21:00 ET

RestrictedPython's guard hooks can be shadowed via positional-only arguments — a sandbox policy bypass

RestrictedPython routes every sensitive operation — attribute access, item access, writes, print — through app-supplied guard hooks like _getattr_, and the name-blocklist meant to stop untrusted code from redefining those hooks checks regular args, *args, **kwargs, and keyword-only args but misses positional-only parameters (CVE-2026-55830, CVSS 8.3). A function defined as `def f(_getattr_=evil, /): return o.x` shadows the real guard with attacker code inside the sandbox — a full policy-enforcement bypass for anything built on RestrictedPython, including Zope and Plone. No patched version listed yet; if you embed RestrictedPython, audit for any path that lets untrusted code define its own function signatures inside the sandbox.

High · GHSA ·added 21:00 ET

MapFish Print's GML layer handler leaks full file contents through its 404 error path — arbitrary file read via XXE

MapFish Print's GML layer handler expands the full contents of a requested file into its 404 error path, so an attacker who can point the print service at a hosted XXE payload (external DTD plus a crafted GML URL) gets arbitrary file read back in the error response — /etc/passwd, k8s secrets, certs, whatever the print-server process can read (CVE-2026-55848, CVSS 8.6). Any deployment that lets end users submit print/export jobs with attacker-controlled layer URLs is exposed by default. A patch is already up on GitHub (commit 13020c0); until you're on it, block outbound requests from the print service to non-allowlisted hosts.

High · GHSA · high · free5GC AUSF (2-advisory batch) ·added 21:00 ET

free5GC's AUSF has two authentication-integrity bugs: concurrent-request context overwrite, plus non-constant-time RES*/XRES* comparisons

free5GC's AUSF component keeps per-subscriber auth state in a global sync.Map keyed only by SUPI with no in-progress check, so concurrent authentication requests for the same SUPI overwrite each other's context and can let one request ride on another's session (CVE-2026-55784, CVSS 7.5). Separately, its RES*/XRES* and AT_MAC comparisons use plain Go equality instead of constant-time functions, and XRES* gets logged in the process (CVE-2026-55785, low on its own). Both weaken the actual authentication guarantee of a 5G core's auth server rather than a peripheral service — relevant if you operate or test against free5GC. No patched version listed for either; rate-limit concurrent auth requests per SUPI as a stopgap.

High · GHSA · high · SeaweedFS (2-advisory batch) ·added 21:00 ET

SeaweedFS: a confused-deputy copy-source bypass breaks S3 bucket isolation, and a second bug lets low-privilege users enumerate admin table buckets

SeaweedFS's S3 gateway hardened URL-path traversal in 4.30 but only checked the X-Amz-Copy-Source header for emptiness, not for `..` segments, so CopyObject/UploadPartCopy requests can still cross bucket boundaries — a confused-deputy bypass where IAM checks the destination bucket the caller owns while the copy source resolves into a bucket they don't (CVE-2026-55874, CVSS 7.7). Separately, the S3Tables/Iceberg REST management API collapses account-less identities into the shared admin account and fails open, so a plain S3 Read credential can enumerate administrator-owned table-bucket names and ARNs (CVE-2026-55873, CVSS 4.3). Patch past 4.30's partial fix; if you run SeaweedFS multi-tenant, audit for cross-bucket copy activity in the interim.

High · GHSA · high · Graylog (2-advisory batch) ·added 21:00 ET

Graylog: a key-value syslog parsing bug enables log evasion against Fortigate-style feeds, plus an IDOR that deletes other users' access tokens

Graylog's key-value syslog parser — the format Fortigate devices emit — can be fed messages that overwrite or corrupt individual fields, or that get dropped outright as invalid (CVE-2026-55841, CVSS 7.5): a log-evasion technique to hide malicious activity from anyone watching Graylog. Separately, an IDOR in the token-revocation endpoint lets any authenticated user delete another user's access token — including service-account and admin tokens — if they know or guess the token ID; no content exposure, but real integrity/availability impact. Fixed in 6.3.12, 7.0.7, and 7.1.2 (Cloud already patched); upgrade, and don't treat a clean Graylog view of Fortigate logs as ground truth until you do.

Medium · GHSA · medium · MariaDB (7-advisory batch) ·added 21:00 ET

MariaDB batch: cleartext password disclosure to a MITM server across the server, JDBC driver, and R2DBC driver, plus a charset-specific SQL injection

MariaDB pushed seven same-window advisories across the server and both connector libraries: a SQL injection in Buffer-parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets (CVE-2026-55855), cleartext password disclosure to a hostile or MITM server during PAM/dialog auth and on the initial TLS handshake (CVE-2026-55854/-55856/-55857/-55860), and charset-confusion data corruption when a server flips character_set_client mid-session (CVE-2026-55858/-55859). Every one of these needs nothing more than a hostile or MITM'd MariaDB server — the common thread is drivers trusting the server's stated charset and auth method instead of enforcing their own. Patch the server and whichever connector (mariadb-java-client, r2dbc-mariadb) your services use; don't assume sslMode alone covers you on an affected version.

Medium · GHSA ·added 21:00 ET

Snipe-IT's permission-preservation safeguard silently drops permissions it doesn't recognize on user edit

Snipe-IT's UsersController::update() unconditionally overwrites $user->permissions with whatever the request's permission field produces, and the safeguard meant to preserve permissions the editor isn't authorized to change only restores the superuser and admin keys — every other permission a user held gets silently dropped, and an admin editing their own account can even have their own admin flag stripped in the process (CVE-2026-55843, CVSS 6.5). It's a data-integrity bug, not an escalation path — the failure mode is unexpected lockouts, not unauthorized privilege gain. Check for a patched release before doing bulk permission edits.

Context · GHSA ·added 21:00 ET

klever-go: an int64 overflow on the SFT add-quantity path bypasses a supposedly finite per-nonce MaxSupply

klever-go's semi-fungible-token add-quantity path (SFTAddCirculation) increments circulation with no overflow guard, so a crafted amount that wraps int64 negative sails past the MaxSupply check and mints a token past its supposed finite cap — the fungible mint path has an equivalent guard and isn't affected (CVE-2026-55764). Narrow blast radius outside anyone running Klever blockchain infrastructure, but the shape — an integer-overflow bypass on a supply cap that's supposed to be authoritative — is the same class of bug that's burned token issuers before. No patched version listed yet.

20:00 ET · First Watch
Critical · Socket · critical · @7nohe/openapi-react-query-codegen (npm) ·added 20:00 ET

Mini Shai-Hulud is back: @7nohe/openapi-react-query-codegen compromised on npm, ten malicious versions shipped with valid provenance

Socket caught ten malicious versions of @7nohe/openapi-react-query-codegen — a widely-used TanStack Query code generator — published to npm carrying valid npm provenance attestations, meaning the attacker controlled the legitimate CI/publish pipeline rather than forging a badge. The payload is worm-shaped: it harvests credentials from the build environment and republishes itself into every other package the compromised maintainer controls, the same self-propagating pattern as the original Shai-Hulud campaign from late 2025. If you depend on this package, treat every maintainer-published version from the compromise window as hostile — pin to a known-good version, rotate any tokens that touched CI on a host that installed it, and grep your lockfiles for the package across every repo, not just the one that flagged it.

Critical · GHSA · critical · Pimcore (5-advisory batch) ·added 20:00 ET

Pimcore: five same-day advisories chain from editor-level access to server RCE and unauthenticated admin takeover with 2FA bypass

Five Pimcore advisories landed within the same hour: an ordinary DataObject-editor can inject arbitrary PHP into a generated class file via an unvalidated field name for RCE (CVE-2026-55634, CVSS 9.9), or reach the same outcome through an unrestricted unserialize() over the Hotspotimage store column using gadgets in Pimcore's own bundled guzzlehttp/guzzle (CVE-2026-55220). A permission-check mixup lets that same editor-level user create class definitions — a structural admin operation — outright (CVE-2026-55212), a DateFilter column-name SQLi exposes admin password hashes to blind extraction (CVE-2026-55208), and worst of the set, an unauthenticated attacker can hijack any admin account with full 2FA bypass by injecting a resetPasswordUrl into the password-reset flow (CVE-2026-55207). No single CVE here is a supply-chain compromise, but the combination — unauthenticated account takeover plus editor-to-RCE — is a full kill chain against any internet-facing Pimcore instance; patch all five immediately, there's no safe subset to defer.

High · GHSA ·added 20:00 ET

Spinnaker's rosco kustomize-bake path deserializes YAML unsafely — RCE on the bake pod for anyone who can submit a kustomize pipeline

Rosco, Spinnaker's image-bake service, processes kustomize manifests through unsafe YAML tag handling (CWE-502, CVSS 7.5), and a crafted manifest submitted through a kustomize bake stage can execute arbitrary code on the rosco pod. This only triggers when a pipeline uses the Kustomize provider, but rosco pods commonly hold cluster and registry credentials, so a compromised bake pod is a foothold straight into your deploy pipeline — exactly the blast radius this watch cares about. No patched version listed yet; Spinnaker's own workaround is to disable kustomize bakes entirely until a fix ships, so switch pipelines to another manifest provider in the meantime.

High · GHSA ·added 20:00 ET

Portainer's unauthenticated /api/restore endpoint gives full admin takeover during every instance's 5-minute boot window

Portainer's backup-restore endpoint is intentionally unauthenticated so a fresh instance can be restored before the first admin exists, but that same 5-minute setup window — which reopens on every restart — lets any network-reachable attacker upload a crafted backup archive with attacker-controlled credentials, or call the admin-init endpoint directly, and walk away with full admin (CVE-2026-55761, high). No auth, no session, no local access needed — just network reachability to an uninitialized instance in the window. If you run Portainer, initialize new instances immediately on first boot and don't leave the management port reachable from untrusted networks between restarts.

Context · GHSA ·added 20:00 ET

ORAS CLI has no cycle detection on OCI referrer graphs — a malicious registry can hang oras discover/backup/restore forever

ORAS CLI's recursive referrer traversal — used by oras discover, backup, and restore to walk OCI artifact relationships — doesn't track visited descriptors, so a malicious or compromised registry returning a cyclic graph (A→A or A→B→A) sends the client into unbounded recursion and memory growth. `oras discover --depth` defaults to unlimited, so this is exploitable out of the box against anyone pulling artifact metadata from a registry they don't fully trust. Low severity — it's a client-side DoS, not data exposure — but ORAS sits directly in the artifact-distribution path for OCI-based supply chains, so treat any registry outside your control as untrusted input until a patched CLI ships.

12:00 ET · Forenoon Watch
High · GHSA ·added 12:00 ET

Phalcon's default router regex has catastrophic backtracking — a ~40-byte URL is enough for a single-request CPU DoS

Every Phalcon MVC app built with the default router compiles a route pattern ending in the nested quantifier `(/.*)*`, and a request path with a run of slashes followed by two newline bytes (`%0a%0a`, which PHP URL-decodes into `$_GET`) forces the regex engine into exponential backtracking — roughly 2^(N/2) for N slashes (CVE-2026-57584). Under default PHP settings the backtrack limit caps the per-request cost at about 1ms but still causes silent 404 mis-routing; with JIT disabled or the backtrack limit raised — both realistic production configs — a ~40-byte request pins a CPU core for seconds to minutes, and volume turns it into worker-pool exhaustion. No patched version is listed yet; strip control characters from request paths at the edge in the meantime, especially if you're on the `URI_SOURCE_GET_URL` router source.

High · GHSA ·added 12:00 ET

Phalcon's Crypt::decrypt uses a non-constant-time HMAC check — the one authenticated-encryption comparison that isn't hash_equals()

Phalcon\Encryption\Crypt::decrypt verifies its HMAC tag with Zephir's `!==` identity comparison, which compiles to a byte-wise memcmp that exits on the first mismatching byte (CVE-2026-54736) — every other MAC/token check in the framework, CSRF and JWT included, already uses the constant-time hash_equals(), making this the odd one out. A Keyczar/CVE-2009-0654-style timing attack can recover a valid tag byte-by-byte against a chosen IV+ciphertext, and combined with CFB's byte-flip malleability that's enough to forge decryptable, tamperable ciphertext the app trusts — think encrypted cookies carrying identity or authorization state. Fixed upstream per the linked issue; if Crypt backs your cookie or session encryption, patch and consider moving to AES-256-GCM while you're in there.

Medium · GHSA ·added 12:00 ET

gix-packetline: reachable panic on an empty side-band packet lets a malicious Git remote crash any gix-based client (pre-auth DoS)

gix-packetline strips a trailing newline with `d[d.len()-1]`, and a git server that sends a side-band line containing only the band-id byte — empty payload — triggers a usize underflow that panics the process during a completely normal clone/fetch, no auth or extra user interaction needed. Any CI pipeline, package manager, or tool built on gix/gix-packetline that fetches from an attacker-influenced remote — a malicious upstream, a compromised mirror, a MITM'd proxy — can be crashed on demand, which matters most for unattended automation with no one watching the exit code. No patched version is listed yet; pin gix-packetline and don't treat repo hosts you don't control as trusted input to fetch operations.

Medium · GHSA ·added 12:00 ET

Hatchet's Dispatcher gRPC lets any tenant hijack another tenant's worker via UpsertWorkerLabels/Unsubscribe

Hatchet's Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe gRPC RPCs read the caller's tenant only for analytics, never to authorize the worker_id in the request body (CVE-2026-54746), so any tenant-scoped API token — down to a brand-new tenant's own OWNER token — can overwrite affinity labels on, or disconnect, a worker UUID belonging to a different tenant on the same Hatchet instance. This bites every multi-tenant deployment including Hatchet Cloud, and turns one leaked low-privilege token into a cross-tenant DoS lever, though the attacker still has to guess the target worker UUID. Patch to 0.91.2+; until then, treat worker UUIDs as sensitive and watch gRPC access logs for cross-tenant worker_id references.

Context · GHSA ·added 12:00 ET

cakephp/queue's unique-job ID check is incomplete — user-controlled params can collide and silently drop jobs

cakephp/queue's uniqueness check for shouldBeUnique jobs derives an identifier from job class, method, and parameters, but the comparison is incomplete enough that attacker-influenced parameters can be crafted to collide with a legitimate job's identifier (CVE-2026-54713). The effect is silent job loss, not code execution or data exposure — a real queued job gets treated as a duplicate and dropped if user input feeds the parameters that build the identifier. Upgrade to 2.3.1, or disable shouldBeUnique and handle idempotency yourself in application code.

06:00 ET · Morning Watch
Context · GHSA ·added 06:00 ET

Kargo's OIDC login flow has an open redirect via redirectTo — phishing setup, not a data or RCE bug

Kargo's UI hands the redirectTo query parameter on /login and /token-renew straight to client-side navigation after OIDC auth completes, and protocol-relative or backslash-prefixed values (//evil.example, /\evil.example) aren't rejected, so a crafted link sends an authenticated user to an attacker-controlled origin (CVE-2026-42350). The bug doesn't expose or modify anything in Kargo itself — its value is that the redirect inherits the trust of a real login flow the victim just completed, making it a credential-phishing setup rather than a direct compromise. No fixed version is called out in the advisory; if you're running Kargo's UI in front of real users, validate redirectTo against an origin allowlist.

Context · The Hacker News ·added 06:00 ET

APT28-linked HOOKEDGE backdoor hits European government targets — batch-script tradecraft, not a supply-chain compromise

Recorded Future's Insikt Group flagged an APT28-linked campaign against government and diplomatic organizations in Romania, Spain, and Türkiye running from late September 2025 through early April 2026, deploying a previously undocumented backdoor dubbed HOOKEDGE — a lightweight Windows batch script rather than a compiled implant. It's an espionage campaign, not a supply-chain attack, but low-footprint script-based backdoors are the same tradecraft shape this watch flags in living-off-the-land tooling compromises, since they blend into normal admin activity and dodge AV signatures tuned for compiled malware. This recap doesn't have delivery-vector or IOC detail — pull the full Insikt writeup if your org has exposure in the targeted regions.