critical

CVE

CVE-2026-111423, CVE-2026-71199, CVE-2026-107884, CVE-2026-118380, CVE-2026-112322, CVE-2026-112323, CVE-2026-40355, CVE-2026-40356, CVE-2026-71200, CVE-2026-107364, CVE-2026-107708, CVE-2026-107778, CVE-2026-112314, CVE-2026-112315, CVE-2026-112316, CVE-2026-112317, CVE-2026-112318, CVE-2026-112319, CVE-2026-112320, CVE-2026-112321, CVE-2026-119079, CVE-2026-108262, CVE-2026-75598, CVE-2026-119078, CVE-2026-124077, CVE-2026-102657, CVE-2026-102289, CVE-2026-119446, CVE-2026-120730, CVE-2026-120999, CVE-2026-109799, CVE-2026-120013, CVE-2026-120012, CVE-2026-88984, CVE-2026-88985, CVE-2026-88982, CVE-2026-88983, CVE-2026-88986, CVE-2026-125704, CVE-2026-125703

CWE

CWE-78, CWE-347, CWE-22, CWE-863, CWE-384, CWE-416, CWE-327, CWE-532

Affected Surface

  • MIT Kerberos 5 (`krb5`) versions `< 1.22.3` (`MITKRB5-SA-2026-001`, 21 CVEs including `CVE-2026-111423` in `>= 1.21`, `CVE-2026-71199` in `>= 1.14`, `CVE-2026-107884` in `>= 1.15`, `CVE-2026-118380` in `>= 1.4`, and `CVE-2026-112322` / `CVE-2026-112323` in `>= 1.5.2`)
  • Python / ISP looking-glass platform `thatmattlove/hyperglass` versions `v2.0.0` through `v2.0.4` (`hyperglass/execution/drivers/_construct.py`, issue `#383` and PR `#382`) and self-hosted PaaS panel `Dokploy/dokploy` through `v0.31.0` (PRs `#5907`, `#5910`, `#5913` through `#5917` merged to `canary` on 9 November 2026)
  • Go `github.com/ddev/ddev` versions `< 1.25.4` (`CVE-2026-108262` / `GHSA-9hq4-hm3j-jmph`, CVSS 8.8 High), Maven `com.gradleup.shadow:com.gradleup.shadow.gradle.plugin` versions `< 9.6.0` (`CVE-2026-75598` / `GHSA-rr8v-fxxf-c986`, CVSS 8.1 High), and `commons-codec:commons-codec` versions `>= 1.16.0, < 1.23.0` (`CVE-2026-119078`, `CVE-2026-124077`)
  • Elixir `nerves-hub/nerves_hub_web` (`CVE-2026-119446` CVSS 9.4 Critical, `CVE-2026-120730` CVSS 8.6 High, `CVE-2026-120999` CVSS 7.4 High), Go `github.com/esm-dev/esm.sh/web` `< 0.2.0` (`CVE-2026-102657` / `GHSA-g3c2-rjq2-c763`, CVSS 7.5 High), PyPI/crates.io `zizmor` `1.27.0` (`CVE-2026-102289` / `GHSA-f42p-wjw5-97qh`), PyPI `sap-cloud-sdk` `< 0.50.0` (`CVE-2026-109799` / `GHSA-93m8-crj2-v997`, `CVE-2026-120013` / `GHSA-28c8-457r-4cf6`) and npm `@sap-ai-sdk/*` (`CVE-2026-120012`), `github.com/kubeflow/pipelines` (`CVE-2026-88984`, `CVE-2026-88985`, `CVE-2026-88982`, `CVE-2026-88983`, `CVE-2026-88986`), GStreamer `< 1.28.9` (`CVE-2026-125704`, `CVE-2026-125703`), and Vim `< 9.2.1308` / `< 9.2.1309` (`GHSA-p99j-mfjp-r4cg`, `GHSA-26qr-jvfj-hcwm`)

TL;DR

Between late 9 November and 10 November 2026, MIT Kerberos, oss-security, the Erlang Ecosystem Foundation, NVD, and the GitHub Advisory Database published 39 vulnerabilities across core authentication libraries, ISP looking-glass servers, container management panels, and developer tooling:

  1. MIT Kerberos 5 (krb5) 1.22.3 patches 21 CVEs (MITKRB5-SA-2026-001, oss-security 2026/11/09/38):
    • Forged PAC and CAMMAC authorization data (CVE-2026-111423 and CVE-2026-71199): In krb5 >= 1.21, verify_pac_checksums() (src/lib/krb5/krb/pac.c) called verify_checksum(..., KRB5_PAC_SERVER_CHECKSUM, ...) without checking its return code ret, and krb5_pac_verify_ext() verified checksums before calling k5_pac_validate_client(), marking a PAC as verified even when the server checksum or client principal failed (CVE-2026-111423). In krb5 >= 1.14, cammac_check_kdcver() and check_svcver() accepted unkeyed checksums in CAMMAC verifiers (CVE-2026-71199). Combined with a KDC loophole where is_kdc_issued_authdatum() did not filter KDC-issued authdata nested inside AD-IF-RELEVANT containers (commit 8137e349a9c1), an authenticated client could request service tickets carrying forged PAC or CAMMAC authorization data.
    • libgssrpc RPCSEC_GSS encryption downgrade (CVE-2026-118380) and kadmind lockdown_keys bypass (CVE-2026-107884): In libgssrpc (>= 1.4), svcauth_gss_accept_sec_context() stored the unverified gc->gc_svc service value sent during context initialization and never updated gd->sec.svc from the verified per-call credential, allowing an active on-path network attacker to trick kadmind into returning iprop incremental database replication replies in cleartext (CVE-2026-118380). In kadmind (>= 1.15), schpw_util_wrapper() failed to check KRB5_KDB_LOCKDOWN_KEYS during password-change requests (CVE-2026-107884). Release 1.22.3 also disables the legacy AUTH_GSSAPI RPC flavor by default (CVE-2026-112322, CVE-2026-112323) and fixes 15 KDC/kadmind/GSS-API DoS and memory-safety CVEs.
  2. hyperglass (<= v2.0.4) pre-auth OS command injection across 36 ISP and hosting looking-glass servers (oss-security 2026/11/10/7, 10/8, thatmattlove/hyperglass#383): Construct.format() in hyperglass/execution/drivers/_construct.py interpolates the unauthenticated POST /api/query queryTarget directly into router command templates via command.format(target=self.target, mask=mask, **attrs) while the default condition="*" validator matches any non-empty line (re.compile(".+").match()). On shell-backed platforms (frr, bird, openbgpd, tnsr), Netmiko sends the string to a POSIX shell (linux_ssh), allowing unauthenticated remote command execution via " / ; / $() in BGP AS-path queries or IPv6 % scope IDs (fe80::1%;id). An internet-wide scan of 388 live hyperglass instances confirmed command execution on 36 hosts across 20 ASNs (11 as root).
  3. Dokploy v0.31.0 backtick database-password RCE and rm -rf command injection (oss-security 2026/11/10/2, PRs #5907, #5910, #5913 through #5917): In Dokploy through v0.31.0, DATABASE_PASSWORD_REGEX (packages/server/src/db/schema/utils.ts) blocked $, !, quotes, \, /, and spaces, but permitted backticks (`) and ; | & ( ) >, while databaseUser had no character filter (z.string().min(1)). Because the Postgres, MySQL, MariaDB, and Mongo changePassword routers placed the password inside single quotes nested within a double-quoted docker exec shell string, bash evaluated backtick command substitutions as uid=0(root) inside the Dokploy container holding /var/run/docker.sock.
  4. DDEV 1.25.4 (CVE-2026-108262, CVSS 8.8), Gradle Shadow 9.6.0 (CVE-2026-75598, CVSS 8.1), Apache Commons Codec 1.23.0 (CVE-2026-119078, CVE-2026-124077), NervesHub (CVE-2026-119446, CVSS 9.4), esm.sh 0.2.0 (CVE-2026-102657), zizmor 1.28.0 (CVE-2026-102289), SAP Cloud SDK (CVE-2026-109799, CVE-2026-120013), GStreamer (CVE-2026-125704), and Vim 9.2.1308/1309: DDEV < 1.25.4 rebased absolute tar symlink targets under dest during validation (filepath.Join(dest, "/etc")) before calling os.Symlink(file.Linkname, ...) with the raw host-absolute path; Gradle Shadow < 9.6.0 copied upstream dependency ZIP entry names containing ../ verbatim into fat JARs; and Apache Commons Codec < 1.23.0 documented a Blake3.doFinalize() KDF pattern that derived identical keys on consecutive calls because doFinalize() does not advance internal state.

Affected packages and components

EcosystemPackage / ProjectCVE / AdvisorySeverityAffected versionsFixed version
C / LinuxMIT Kerberos 5 (krb5)CVE-2026-111423, CVE-2026-71199, CVE-2026-107884, CVE-2026-118380, CVE-2026-112322, CVE-2026-112323, plus 15 DoS CVEs (MITKRB5-SA-2026-001)High / Medium< 1.22.3 (111423 in >= 1.21; 71199 in >= 1.14; 107884 in >= 1.15; 118380 in >= 1.4)1.22.3
Pythonthatmattlove/hyperglassIssue #383 / PR #382 (oss-security 2026/11/10/8)Critical (exploited across 36 ISP/ASN hosts)v2.0.0 through v2.0.4Apply PR #382 (shlex.quote + control-char filter)
Node.js / DockerDokploy/dokployoss-security 2026/11/10/2 (PRs #5907, #5910, #5913..#5917)Critical (9.9 vendor vector)<= v0.31.0canary commits 1c862c9cb042, 903b4ee4d1e0, c819a33ea527, 1e21508c54c6, fd61ce9ab0b2
Gogithub.com/ddev/ddevCVE-2026-108262 (GHSA-9hq4-hm3j-jmph, incomplete fix for CVE-2026-32885)High (8.8)< 1.25.41.25.4
Mavencom.gradleup.shadow:com.gradleup.shadow.gradle.pluginCVE-2026-75598 (GHSA-rr8v-fxxf-c986)High (8.1)< 9.6.09.6.0
Mavencommons-codec:commons-codecCVE-2026-119078, CVE-2026-124077Important / Low>= 1.16.0, < 1.23.0 (119078); >= 1.22.0, < 1.23.0 (124077)1.23.0 (callers must also replace repeated Blake3.doFinalize() calls)
Elixirnerves-hub/nerves_hub_webCVE-2026-119446, CVE-2026-120730, CVE-2026-120999, CVE-2026-120295, CVE-2026-120286, CVE-2026-120997Critical (9.4) / High (8.6, 7.4, 7.1)Prior to commits 3131f1701194, c367d7d17d07, 54dbf93c3bd3Commits 3131f1701194, c367d7d17d07, 54dbf93c3bd3, 1bc8be875ab6
Gogithub.com/esm-dev/esm.sh/webCVE-2026-102657 (GHSA-g3c2-rjq2-c763)High (7.5)< 0.2.0 (< v137_7)0.2.0 (v137_7)
PyPI / crates.iozizmor (zizmorcore/zizmor)CVE-2026-102289 (GHSA-f42p-wjw5-97qh)High1.27.01.28.0
PyPI / npmsap-cloud-sdk (SAP/cloud-sdk-python), @sap-ai-sdk/* (SAP/ai-sdk-js)CVE-2026-109799 (GHSA-93m8-crj2-v997), CVE-2026-120013 (GHSA-28c8-457r-4cf6), CVE-2026-120012 (GHSA-8g7j-49xg-8wf3)High (7.5)sap-cloud-sdk < 0.50.0 (120013) / prior to 0.65.4>= 0.50.0 / 0.65.4
Gogithub.com/kubeflow/pipelinesCVE-2026-88984 (GHSA-ghgh-57qv-h687), CVE-2026-88985 (GHSA-r4mx-2gr2-8277), CVE-2026-88982, CVE-2026-88983, CVE-2026-88986High / Medium (6.5)< 2.16.1 (88984), < 2.17.0 (88985, 88983), < 2.18.0 (88982)2.18.0
CGStreamer (gstreamer) and Vim (vim/vim)CVE-2026-125704 (SA-2026-0028), CVE-2026-125703; Vim GHSA-p99j-mfjp-r4cg, GHSA-26qr-jvfj-hcwmHigh (7.5) / MediumGStreamer < 1.28.9 (MR !11583); Vim < 9.2.1308 / < 9.2.1309GStreamer MR !11583; Vim 9.2.1308 & 9.2.1309

Technical analysis

1. MIT Kerberos 5 1.22.3 (MITKRB5-SA-2026-001): PAC checksum bypass (CVE-2026-111423), unkeyed CAMMAC verifiers (CVE-2026-71199), and RPCSEC_GSS downgrade (CVE-2026-118380)

MIT krb5-1.22.3 fixes 21 CVEs uncovered during LLM-assisted security audits by researchers from Ada Logics, Anthropic, AISLE, AWS Security, Deutsche Bank, Red Hat, and Talence Security. Three flaws affect authorization data and RPC transport integrity:

  1. Unchecked PAC server checksum result and premature pac->verified flag (CVE-2026-111423, commit ffb49b20a30c): In src/lib/krb5/krb/pac.c, verify_pac_checksums() computed ret = verify_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, server, KRB5_KEYUSAGE_APP_DATA_CKSUM, &copy) and then fell straight through without checking if (ret) goto cleanup;. When privsvr was NULL or expect_full_checksum was FALSE, the function reached pac->verified = TRUE; return 0; even when the server checksum failed. Furthermore, krb5_pac_verify_ext() called verify_pac_checksums() (which set pac->verified = TRUE) before calling k5_pac_validate_client(): 
    --- a/src/lib/krb5/krb/pac.c
+++ b/src/lib/krb5/krb/pac.c
@@ -538,6 +538,8 @@ verify_pac_checksums(krb5_context context, const krb5_pac pac,
         /* Verify the server checksum over the PAC copy. */
         ret = verify_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, server,
                               KRB5_KEYUSAGE_APP_DATA_CKSUM, &copy);
+        if (ret)
+            goto cleanup;
     }
  2. Unkeyed CAMMAC checksums (CVE-2026-71199, commit d97f92d1afd8) and nested AD-IF-RELEVANT KDC authdata smuggling (commit 8137e349a9c1): When the KDC filtered client-supplied authorization data in is_kdc_issued_authdatum() (src/kdc/kdc_authdata.c), it inspected only one level of KRB5_AUTHDATA_IF_RELEVANT, allowing a client to smuggle forged KRB5_AUTHDATA_WIN2K_PAC or KRB5_AUTHDATA_CAMMAC elements inside a nested AD-IF-RELEVANT container where krb5_find_authdata() still located them. Meanwhile, neither cammac_check_kdcver() (src/kdc/cammac.c) nor check_svcver() (src/lib/krb5/krb/cammac_util.c) checked krb5_c_is_keyed_cksum(ver->checksum.checksum_type), allowing an authenticated client to forge CAMMAC verifiers using an unkeyed hash (such as CRC32 or MD5) and spoof authentication indicators.
  3. libgssrpc RPCSEC_GSS unverified service level (CVE-2026-118380, commit 2cda39a6c0a2): During RPCSEC_GSS_INIT, the rpc_gss_cred header is not covered by the context verifier. However, svcauth_gss_accept_sec_context() in src/lib/rpc/svc_auth_gss.c saved gd->sec.svc = gc->gc_svc from that initial unverified packet and never updated gd->sec.svc from the integrity-protected gc->gc_svc field on subsequent RPCSEC_GSS_DATA calls. An on-path attacker between a primary kadmind and a replica KDC could modify gc_svc to RPCSEC_GSS_SVC_NONE during RPCSEC_GSS_INIT, causing kadmind to transmit iprop incremental KDB replication replies in plaintext.

2. hyperglass (<= v2.0.4) pre-auth OS command injection and Dokploy v0.31.0 backtick host RCE

In thatmattlove/hyperglass (v2.0.0 through v2.0.4, thatmattlove/hyperglass#383 and PR #382), the unauthenticated POST /api/query endpoint passes queryTarget to Construct.format() in hyperglass/execution/drivers/_construct.py:

--- a/hyperglass/execution/drivers/_construct.py
+++ b/hyperglass/execution/drivers/_construct.py
@@ -110,7 +111,12 @@ def format(self, command: str) -> str:
         except ValueError:
             pass
 
-        return command.format(target=self.target, mask=mask, **attrs)
+        fmt = {"target": self.target, "mask": mask, **attrs}
+
+        if self.device.platform in SHELL_PLATFORMS:
+            return " ".join(shlex.quote(word.format(**fmt)) for word in shlex.split(command))
+
+        return command.format(**fmt)

Because built-in BGP AS-path and community directives use condition="*" (re.compile(".+").match()), any string without a leading newline passes validation. On FRR (vtysh -c "show bgp ipv4 unicast regexp {target}"), OpenBGPD (bgpctl show rib inet as {target}), TNSR, and BIRD (where Python’s ipaddress.ip_address("fe80::1%;id") accepts arbitrary shell commands after the IPv6 % zone delimiter and interpolates the raw target into ping -6 ... {target}), Netmiko executes the formatted string inside bash (device_type="linux_ssh").

In Dokploy/dokploy (<= v0.31.0, oss-security 2026/11/10/2), DATABASE_PASSWORD_REGEX in packages/server/src/db/schema/utils.ts (lines 51-52) rejected $, !, ', ", \, /, and spaces, but allowed backticks (`) and ; | & ( ) >. In apps/dokploy/server/api/routers/postgres.ts (and mysql.ts, mariadb.ts, mongo.ts), changePassword interpolated password and unvalidated databaseUser inside a double-quoted bash string (commit 1c862c9cb042):

--- a/apps/dokploy/server/api/routers/postgres.ts
+++ b/apps/dokploy/server/api/routers/postgres.ts
@@ -446,7 +447,15 @@ export const postgresRouter = createTRPCRouter({
-			const command = `docker exec ${container.Id} psql -U ${databaseUser} -d postgres -c "ALTER USER \\"${databaseUser}\\" WITH PASSWORD '${password}';"`;
+			const command = `docker exec ${container.Id} ${quote([
+				"psql",
+				"-U",
+				databaseUser,
+				"-d",
+				"postgres",
+				"-c",
+				`ALTER USER "${databaseUser}" WITH PASSWORD '${password}';`,
+			])}`;

Because single quotes inside double quotes ("... '${password}' ...") do not suppress bash backtick command substitution, any organization member with service: ["create"] on a database could supply a backtick expression (or a semicolon in databaseUser) to execute commands as uid=0(root) inside the Dokploy server container that mounts the host’s /var/run/docker.sock. Six companion PRs merged to canary on 9 November (#5907, #5913 through #5917) also replace execAsync(\rm -rf ${path}`)withfsPromises.rm()inpackages/server/src/utils/filesystem/directory.ts (903b4ee4d1e0), lock down apiUpdateUser mass assignment (c819a33ea527), and enforce checkEnvironmentAccessandassertSshKeyInOrganization across tenants (1e21508c54c6, fd61ce9ab0b2`).

3. DDEV 1.25.4 (CVE-2026-108262), Gradle Shadow 9.6.0 (CVE-2026-75598), Apache Commons Codec 1.23.0 (CVE-2026-119078), NervesHub (CVE-2026-119446), esm.sh (CVE-2026-102657), zizmor 1.28.0 (CVE-2026-102289), and SAP Cloud SDK (CVE-2026-109799)

  1. DDEV < 1.25.4 absolute tar symlink escape (CVE-2026-108262 / GHSA-9hq4-hm3j-jmph, CVSS 8.8 High, commit 7034963403c5): When DDEV 1.25.2 patched CVE-2026-32885 in pkg/archive/archive.go (Untar), it validated absolute symlink targets by rebasing them into dest (if filepath.IsAbs(file.Linkname) { resolvedTarget = filepath.Join(dest, file.Linkname) }), which always remained inside dest unless it contained ... Immediately after that check passed, Untar called os.Symlink(file.Linkname, fullPath) with the un-rebased host-absolute path (such as /etc or $HOME), allowing a subsequent archive entry to overwrite arbitrary host files through the symlink. Commit 7034963403c5 adds isArchiveAbsolutePath() and rejects any symlink target starting with /, \, or filepath.IsAbs().
  2. Gradle Shadow < 9.6.0 fat-JAR Zip Slip (CVE-2026-75598 / GHSA-rr8v-fxxf-c986, CVSS 8.1 High, commit 0c2744fcc050): In src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/internal/Utils.kt, zipEntry(name) constructed ZipEntry(name) without checking for .. path segments, propagating any ../../../../ entry from an upstream JAR into the output shadow JAR. Version 9.6.0 throws a GradleException whenever name.split('/', '\\').any { it == ".." }.
  3. Apache Commons Codec < 1.23.0 stateless Blake3.doFinalize() KDF key reuse (CVE-2026-119078) and GitIdentifiers NUL collisions (CVE-2026-124077, commit 87f6aa281883): Since commons-codec 1.16.0, the Javadoc on org.apache.commons.codec.digest.Blake3 stated that doFinalize(byte[]) advanced the XOF output offset, and its KDF code example derived two distinct keys by calling kdf.doFinalize(key1); kdf.doFinalize(key2); on the same Blake3 instance. In reality, doFinalize() does not mutate the EngineState, so key1 and key2 receive identical bytes. Applications must request the combined byte length in a single doFinalize(combinedLen) call and slice the returned array.
  4. NervesHub nerves_hub_web CLI session fixation (CVE-2026-119446, CVSS 9.4 Critical, commit 3131f1701194) and OrgKey / Device mass assignment (CVE-2026-120730, CVSS 8.6 High, commit c367d7d17d07): In nerves_hub_web, the CLI login flow placed the session token in the web confirmation URL, allowing an unauthenticated attacker who started a CLI login session to trick a signed-in user into confirming that URL and minting an API token for the victim’s account (CVE-2026-119446). Commit 3131f1701194 replaces URL-token confirmation with an 8-digit confirmation_code typed by the user.
  5. esm.sh < 0.2.0 %2e%2e file read (CVE-2026-102657 / GHSA-g3c2-rjq2-c763, commit 468b6b2a4b4d), zizmor 1.27.0 cleartext token logging (CVE-2026-102289 / GHSA-f42p-wjw5-97qh, commit 0731e01706af), SAP Cloud SDK for Python (CVE-2026-109799, CVE-2026-120013), GStreamer (CVE-2026-125704, MR !11583), and Vim 9.2.1308/1309: esm.sh’s web.NewHandler joined r.URL.Path directly with s.config.AppDir after ServeMux decoded %2e%2e segments; zizmor 1.27.0 derived #[derive(Debug)] on struct GitHubToken(String) and printed GH_TOKEN/GITHUB_TOKEN to stderr under -v; SAP/cloud-sdk-python’s IASContextProvider decoded app_tid, sap_gtid, and user_uuid from IAS JWTs without verifying the signature (CVE-2026-109799) and agent_memory.create_client(tenant=...) allowed ../ traversal across /etc/secrets/appfnd/hana-agent-memory/<tenant>/ (CVE-2026-120013); GStreamer’s gstvalue.c (wrong_char: label) called gst_buffer_unref(buffer) before gst_buffer_unmap(buffer, &info) (CVE-2026-125704); and Vim < 9.2.1308 trusted pre-created /tmp/vim-<uid> directories in socketserver_get_path() (GHSA-p99j-mfjp-r4cg, commit a448e0c6bc45).

IOCs

  • hyperglass exploitation indicators:
    • HTTP POST /api/query requests containing shell metacharacters (", ;, `, $(...)), IPv6 % scope-ID separators (fe80::1%;...), or embedded newlines (\n) inside queryTarget.
    • Unexpected child processes spawned under the hyperglass or router SSH user via vtysh -c, birdc, bgpctl, or ping -6.
  • Dokploy exploitation indicators:
    • postgres.changePassword, mysql.changePassword, mariadb.changePassword, or mongo.changePassword tRPC calls containing backticks (`) in password or semicolons/shell metacharacters in databaseUser.
  • krb5 network and KDC indicators:
    • Service ticket requests containing nested AD-IF-RELEVANT (type 1) authorization data containers wrapping AD-WIN2K-PAC (128) or AD-CAMMAC (96), or RPCSEC_GSS_INIT packets setting gc_svc = RPCSEC_GSS_SVC_NONE against kadmind.

Detection and remediation

# 1. Check installed MIT Kerberos 5, GStreamer, Vim, and DDEV versions
krb5-config --version 2>/dev/null || true
gst-launch-1.0 --version 2>/dev/null || true
vim --version 2>/dev/null | head -n 2 || true
ddev --version 2>/dev/null || true

# 2. Audit Java / Kotlin codebases for repeated Blake3.doFinalize() calls (CVE-2026-119078) and Gradle Shadow < 9.6.0
rg -n 'doFinalize\s*\(' --glob '*.{java,kt}' 2>/dev/null
rg -n 'com\.gradleup\.shadow|commons-codec' pom.xml build.gradle* gradle/libs.versions.toml 2>/dev/null

# 3. Check Python, Go, and Rust manifests for hyperglass, sap-cloud-sdk, zizmor, esm.sh, and kubeflow/pipelines
rg -n 'hyperglass|sap-cloud-sdk|zizmor|esm\.sh|kubeflow/pipelines' \
  pyproject.toml requirements*.txt uv.lock Cargo.lock go.mod 2>/dev/null
  1. Upgrade MIT krb5 to 1.22.3 on KDCs, kadmind servers, and GSS-API application servers: Upgrading the KDC to 1.22.3 blocks both fake CAMMAC (CVE-2026-71199) and nested AD-IF-RELEVANT fake PAC ticket issuance; upgrading kadmind on the primary KDC also prevents RPCSEC_GSS iprop downgrade attacks (CVE-2026-118380) and disables legacy AUTH_GSSAPI (CVE-2026-112322, CVE-2026-112323).
  2. Restrict or patch hyperglass (<= v2.0.4) and Dokploy (<= v0.31.0) immediately: On any internet-facing hyperglass instance, apply PR #382 (shlex.quote on SHELL_PLATFORMS and ^[^\x00-\x1f\x7f]+$ on QueryTarget) and rotate all SSH keys and router credentials stored on the hyperglass host if it was reachable from the internet. On Dokploy, deploy the 9 November canary security commits (1c862c9cb042 through fd61ce9ab0b2).
  3. Update DDEV to >= 1.25.4, Gradle Shadow to >= 9.6.0, zizmor to >= 1.28.0, esm.sh to >= 0.2.0, and audit Blake3.doFinalize() callers: If CI workflows ran zizmor 1.27.0 with -v / --verbose or RUST_LOG=debug, rotate any GH_TOKEN, GITHUB_TOKEN, or ZIZMOR_GITHUB_TOKEN printed to build logs. In Java applications using org.apache.commons.codec.digest.Blake3, replace consecutive doFinalize() calls on the same instance with a single doFinalize(totalBytes) call and split the output array.

Timeline

  • 2026-07-14 to 2026-07-15: thatmattlove/hyperglass PR #382 and issue #383 are opened documenting unescaped command.format() shell injection across frr, bird, openbgpd, and tnsr.
  • 2026-11-05 to 2026-11-06: MIT Kerberos commits the 21 CVE fixes to the krb5-1.22 branch (d97f92d1afd8 through f5bee90a501d); SAP merges cloud-sdk-python 0.65.3 / 0.65.4 fixes.
  • 2026-11-08 (20:20 to 21:59 UTC): Vim publishes 9.2.1308 (GHSA-p99j-mfjp-r4cg, /tmp/vim-<uid> socket directory hijack) and 9.2.1309 (GHSA-26qr-jvfj-hcwm, .spl spell-file heap over-read) on oss-security.
  • 2026-11-09 (16:57 to 23:54 UTC): Dokploy merges seven security PRs (#5907, #5910, #5913 through #5917) to canary; Apache announces CVE-2026-119078 and CVE-2026-124077 for Commons Codec 1.23.0; GitHub publishes reviewed advisories for Gradle Shadow 9.6.0 (CVE-2026-75598), zizmor 1.28.0 (CVE-2026-102289), esm.sh 0.2.0 (CVE-2026-102657), DDEV 1.25.4 (CVE-2026-108262), and Kubeflow Pipelines (CVE-2026-88982 through 88986); and MIT releases krb5-1.22.3 (MITKRB5-SA-2026-001).
  • 2026-11-10 (01:17 to 11:16 UTC): NVD and oss-security publish the Dokploy v0.31.0 backtick RCE analysis (10/2), the hyperglass 36-host / 20-ASN exploitation report (10/7 and 10/8), the SAP Cloud SDK advisories (CVE-2026-109799, CVE-2026-120013, CVE-2026-120012), the NervesHub advisories (CVE-2026-119446, CVE-2026-120730, CVE-2026-120999), and GStreamer CVE-2026-125704.

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Get Demo

References