critical

CVE

CVE-2026-68982, CVE-2026-86829, CVE-2026-76185, CVE-2026-82337, CVE-2026-96285, CVE-2026-111421, CVE-2026-111395, CVE-2026-107474, CVE-2026-50204, CVE-2026-113504, CVE-2026-111452, CVE-2026-86468, CVE-2026-101031, CVE-2026-113508, CVE-2026-111453, CVE-2026-111454, CVE-2026-111455, CVE-2026-40913, CVE-2026-123870, CVE-2026-123717, CVE-2026-92683, CVE-2026-82436, CVE-2026-82440, CVE-2026-120761, CVE-2026-123753, CVE-2026-120832, CVE-2026-123766, CVE-2026-123770, CVE-2026-120367, CVE-2026-123779

CWE

CWE-502, CWE-306, CWE-94, CWE-863, CWE-918, CWE-611, CWE-400, CWE-522, CWE-78

Affected Surface

  • PyPI `apache-airflow` versions `< 3.4.0` and `apache-airflow-task-sdk` versions `>= 1.2.0, < 1.4.0` (18 CVEs: `CVE-2026-68982`, `CVE-2026-86829`, `CVE-2026-76185`, `CVE-2026-82337`, `CVE-2026-96285`, `CVE-2026-111421`, `CVE-2026-111395`, `CVE-2026-107474`, `CVE-2026-50204`, `CVE-2026-113504`, `CVE-2026-111452`, `CVE-2026-86468`, `CVE-2026-101031`, `CVE-2026-113508`, `CVE-2026-111453`, `CVE-2026-111454`, `CVE-2026-111455`, and `CVE-2026-40913`)
  • crates.io `rmcp` (`modelcontextprotocol/rust-sdk`) versions `>= 0.2.0, < 3.9.0` (`RUSTSEC-2026-0457` / `GHSA-5p52-q7pq-9fq2` fixed in `3.7.0`, `RUSTSEC-2026-0461` / `GHSA-4432-vg92-fqh6` fixed in `3.6.0`, and `RUSTSEC-2026-0462` / `GHSA-c9f9-cp8h-jcj5` fixed in `3.9.0`)
  • PyPI `otterdog` (`eclipse-csi/otterdog` `< 1.8.0` for `CVE-2026-123717` / `GHSA-886p-g538-rcmp` CVSS 8.8 High in `pass` and `bitwarden` credential providers, and webapp prior to commit `bbc9e3ced366` for `CVE-2026-123870` / `GHSA-32xf-7j44-xq72` CVSS 9.5 Critical) and npm `@neo4j/graphql` versions `>= 7.0.0, < 7.6.7` (`CVE-2026-92683` / `GHSA-58qp-3mmm-5vh8`, CVSS 8.6 High)
  • Maven `org.apache.storm:storm-client` and `storm-server` versions `>= 3.0.0, < 3.1.0` (`CVE-2026-82436` Important and `CVE-2026-82440` Moderate, fixed in `3.1.0`) and `org.apache.axis2:*` versions `< 2.0.2` (`CVE-2026-120761`, `CVE-2026-123753`, `CVE-2026-120832`, `CVE-2026-123766`, `CVE-2026-123770`, `CVE-2026-120367`, and `CVE-2026-123779`, fixed in `2.0.2`)

Update, 10 November 2026: On 10 November 2026 (12:17 UTC), the Eclipse Foundation released Eclipse otterdog 1.8.0 on PyPI and published CVE-2026-123717 / GHSA-886p-g538-rcmp (CVSS 8.8 High, fixed in commit e3cc9997026a). In otterdog <= 1.7.1, otterdog/credentials/pass_provider.py and otterdog/credentials/bitwarden_provider.py invoked subprocess.getstatusoutput(f"pass {key} 2>/dev/null") and subprocess.getstatusoutput(f"bw get item {item_id}"), which pass the formatted string directly to /bin/sh -c (otterdog/operations/canonical_diff.py also invoked asyncio.create_subprocess_shell(f"diff --label {name_a} ...")). Any user able to modify an organization configuration could place shell metacharacters or leading - flags inside a pass:<path> or bitwarden:<item>@<field> secret reference to execute arbitrary commands as the operator running otterdog (with full access to the unlocked pass or Bitwarden vault). Version 1.8.0 replaces subprocess.getstatusoutput() and create_subprocess_shell() with an argv-based run_command_sync() helper (subprocess.run([cmd, *args], shell=False)), passes explicit "show" to pass, and rejects keys or item IDs starting with "-".

TL;DR

On 9 November 2026 (05:02 to 11:17 UTC), the Apache Software Foundation, the RustSec Advisory Database, the Eclipse Foundation, and Neo4j published 33 advisories across data pipelines, Model Context Protocol (MCP) SDKs, GraphQL authorization layers, and enterprise Java services:

  1. Apache Airflow 3.4.0 and Task SDK 1.4.0 patch 18 CVEs (oss-security 2026/11/09/3 through 09/20):
    • Unvalidated ExecuteCallback workloads on CeleryExecutor workers (CVE-2026-68982, Important): Celery workers ran ExecuteCallback deadline-alert workloads without validating or redeeming the workload JWT with the Execution API, allowing any party with write access to the Celery broker (such as Redis or RabbitMQ) to execute arbitrary Python code on every Celery worker without Airflow credentials.
    • Scheduler and API server object deserialization (CVE-2026-86829 Important, CVE-2026-82337 Moderate, CVE-2026-96285 Moderate, CVE-2026-111421 Moderate, and CVE-2026-111395 Moderate): The Airflow scheduler deserialized task-written XCom values with full=True (XComDecoder.object_hook) inside NotPreviouslySkippedDep and TriggerRuleDep, letting a DAG author instantiate arbitrary airflow.* classes inside the privileged scheduler process (CVE-2026-86829). Three companion advisories fix incomplete patches for earlier CVEs: DeadlineAlert callback and interval fields (CVE-2026-82337, incomplete fix for CVE-2026-45360), next_kwargs deserializing nested objects before checking isinstance(..., dict) (CVE-2026-96285, incomplete fix for CVE-2026-67260), and Task Execution API set_xcom skipping reserved-key checks (CVE-2026-111421, incomplete fix for CVE-2026-59242).
    • Multi-team SecretCache key collision (CVE-2026-76185, Important) and 11 secret-exposure, CLI, and RBAC flaws: In apache-airflow-task-sdk 1.2.0 to 1.3.2, SecretCache joined prefix, optional team_name, and key with unescaped _ delimiters (f"{prefix}_{team_name}_{key}"), so a teamless task requesting Variable _analytics_DB_PASSWORD collided with team analytics’s DB_PASSWORD secret. Eleven additional CVEs fix cleartext secrets in audit logs (CVE-2026-50204, CVE-2026-86468), Apprise connection config extras (CVE-2026-107474), camelCase and depth-5 secret-masker bypasses (CVE-2026-111452, CVE-2026-113504), IPv6 zone-ID command injection in example_dag_decorator (CVE-2026-101031, incomplete fix for CVE-2025-54941), silent logout token revocation failures (CVE-2026-113508), and asset/connection RBAC gaps (CVE-2026-111453 to 111455, CVE-2026-40913).
  2. Official Rust MCP SDK rmcp 3.6.0 / 3.7.0 / 3.9.0 (RUSTSEC-2026-0457, RUSTSEC-2026-0461, RUSTSEC-2026-0462): rmcp’s OAuth client validated authorization-server metadata URLs by checking only the URL host string without resolving DNS, failed to strip brackets from IPv6 literals (http://[::1]:6379/), and skipped token_endpoint and registration_endpoint checks (RUSTSEC-2026-0457, fixed in 3.7.0); StreamableHttpService cached ServerHandler::get_tool in an unbounded map keyed by untrusted tools/call names before authentication (RUSTSEC-2026-0461, fixed in 3.6.0); and Streamable HTTP clients buffered unbounded response bodies during initialize (RUSTSEC-2026-0462, fixed in 3.9.0).
  3. Eclipse otterdog (CVE-2026-123870, CVSS 9.5 Critical) and Neo4j @neo4j/graphql 7.6.7 (CVE-2026-92683, CVSS 8.6 High): In otterdog, _log_event() evaluated eval(EVENT_FILTER[event_type].format(**data)) on incoming GitHub webhook payloads while _get_digest() skipped X-Hub-Signature verification whenever GITHUB_WEBHOOK_SECRET was left at its None default. In @neo4j/graphql 7.0.0 through 7.6.6, filterByValues() returned immediately after evaluating the first condition in a multi-condition @authentication(jwt: ...) filter, ignoring all subsequent role or claim checks.
  4. Apache Storm 3.1.0 (CVE-2026-82436, CVE-2026-82440) and Apache Axis2/Java 2.0.2 (7 CVEs): Storm 3.0.0 configured Kryo in DefaultStateSerializer with setRegistrationRequired(false) and StdInstantiatorStrategy, allowing anyone able to write to a shared Redis state store to execute arbitrary code in worker JVMs (CVE-2026-82436), and treated an unset nimbus.scheduler.strategy.class.whitelist as “allow any class” (CVE-2026-82440). Axis2 2.0.2 fixes WSDL import XXE in wsdl4j (CVE-2026-120761), unauthenticated SSRF via non-anonymous WS-Addressing wsa:ReplyTo / wsa:FaultTo endpoints (CVE-2026-123753) and wsdl:import / xsd:import URLs (CVE-2026-120832), OpenAPI Swagger UI Host-header XSS (CVE-2026-123766), unbounded multipart/JSON request body OOMs (CVE-2026-123770, CVE-2026-120367), and ?wsdl forced browsing (CVE-2026-123779).

What to do now: Upgrade apache-airflow to >= 3.4.0 and apache-airflow-task-sdk to >= 1.4.0, rmcp to >= 3.9.0, @neo4j/graphql to >= 7.6.7, Apache Storm (org.apache.storm:*) to 3.1.0, Apache Axis2 (org.apache.axis2:*) to 2.0.2, and deploy Eclipse otterdog with commit bbc9e3ced366 and a non-empty GITHUB_WEBHOOK_SECRET.

Affected packages and components

EcosystemPackage / ProjectCVE / AdvisorySeverityAffected versionsFixed version
PyPIapache-airflowCVE-2026-68982, CVE-2026-86829, CVE-2026-82337, CVE-2026-96285, CVE-2026-111421, CVE-2026-111395, CVE-2026-107474, CVE-2026-50204, CVE-2026-113504, CVE-2026-111452, CVE-2026-86468, CVE-2026-101031, CVE-2026-113508, CVE-2026-111453..111455, CVE-2026-40913Important (High) / Moderate / Low< 3.4.0 (96285 and 111455 affect >= 3.3.0, < 3.4.0; 111453 affects 3.3.2)3.4.0
PyPIapache-airflow-task-sdkCVE-2026-76185Important (High)>= 1.2.0, < 1.4.01.4.0 (with Airflow 3.4.0)
crates.iormcp (modelcontextprotocol/rust-sdk)RUSTSEC-2026-0457 (GHSA-5p52-q7pq-9fq2), RUSTSEC-2026-0461 (GHSA-4432-vg92-fqh6), RUSTSEC-2026-0462 (GHSA-c9f9-cp8h-jcj5)High (7.5) / Medium>= 2.0.0, < 3.7.0 (0457); >= 3.0.0, < 3.6.0 (0461); >= 0.2.0, < 3.9.0 (0462)3.9.0 (3.7.0 for 0457; 3.6.0 for 0461)
PyPI / Pythonotterdog (eclipse-csi/otterdog)CVE-2026-123870 (GHSA-32xf-7j44-xq72)Critical (9.5)Prior to commit bbc9e3ced366Commit bbc9e3ced366
npm@neo4j/graphqlCVE-2026-92683 (GHSA-58qp-3mmm-5vh8)High (8.6)>= 7.0.0, < 7.6.77.6.7
Mavenorg.apache.storm:storm-client, storm-serverCVE-2026-82436, CVE-2026-82440Important (High) / Moderate>= 3.0.0, < 3.1.03.1.0
Mavenorg.apache.axis2:axis2-kernel, axis2-addressing, axis2-json, axis2-openapiCVE-2026-120761, CVE-2026-123753, CVE-2026-120832, CVE-2026-123766, CVE-2026-123770, CVE-2026-120367, CVE-2026-123779High / Medium< 2.0.22.0.2

Technical analysis

1. Apache Airflow 3.4.0: CeleryExecutor forged callbacks (CVE-2026-68982), Scheduler XCom deserialization (CVE-2026-86829), and SecretCache collisions (CVE-2026-76185)

In Airflow 3’s Task Execution API architecture, workers do not connect directly to the metadata database; instead, the scheduler mints a scoped JWT for each workload (ExecuteTask or ExecuteCallback). For normal tasks, the worker redeems that workload token at PATCH /execution/task-instances/{ti_id}/run before running user code. However, for ExecuteCallback workloads (used by deadline alerts), supervise_callback() in task-sdk/src/airflow/sdk/execution_time/callback_supervisor.py imported and executed the callback subprocess directly from the broker payload without ever calling the Execution API (CVE-2026-68982). Anyone with network write access to the Celery broker (Redis or RabbitMQ) could enqueue a crafted ExecuteCallback message with a dummy token and execute arbitrary commands on every CeleryExecutor worker. PR #71192 stamps ExecuteCallback tokens with token_scope = "callback" and requires supervise_callback() to exchange the single-use token via PATCH /execution/callbacks/{callback_id}/run (which atomically transitions Callback.state from QUEUED to RUNNING and returns 409 on replay) before starting CallbackSubprocess.

Meanwhile, in the scheduler, NotPreviouslySkippedDep and TriggerRuleDep read skipmixin_key and past_depends_met XCom values by calling ti.xcom_pull(), which invoked XComModel.deserialize_value() (json.loads(value, cls=XComDecoder) with full=True). A task that wrote a pre-serialized {"__classname__": "...", "__version__": 1, "__data__": ...} envelope via the Execution API (XComModel.set(..., serialize=False)) caused the scheduler process itself to import and instantiate the named class during dependency evaluation (CVE-2026-86829). PR #72718 adds XComModel.deserialize_value_primitives() (plain json.loads with no object_hook) and passes full=False across all scheduler dependency checks.

In apache-airflow-task-sdk (CVE-2026-76185, PR #72201), SecretCache constructed its internal dictionary key by string concatenation:

--- a/task-sdk/src/airflow/sdk/execution_time/cache.py
+++ b/task-sdk/src/airflow/sdk/execution_time/cache.py
@@ -45,7 +60,18 @@ class SecretCache:
     _VARIABLE_PREFIX = "__v_"
     _CONNECTION_PREFIX = "__c_"
-    _TEAM_PATTERN = "_{}_"
+
+    @staticmethod
+    def _key(prefix: str, team_name: str | None, key: str) -> _CacheKey:
+        return _CacheKey(prefix, team_name, key)

Because team = f"_{team_name}_" if team_name else "" was concatenated into f"{prefix}{team}{key}", team analytics saving Variable DB_PASSWORD wrote to key "__v__analytics_DB_PASSWORD", which is byte-for-byte identical to a teamless task requesting Variable "_analytics_DB_PASSWORD" or team analytics_DB requesting "PASSWORD". Replacing the string key with _CacheKey(NamedTuple) ((prefix, team_name, key)) makes cache lookups injective.

2. Official Rust MCP SDK rmcp 3.6.0 / 3.7.0 / 3.9.0 (RUSTSEC-2026-0457, RUSTSEC-2026-0461, RUSTSEC-2026-0462)

Three advisories in modelcontextprotocol/rust-sdk (rmcp) harden both the MCP client and server transports:

  • OAuth discovery DNS, [::1], and token-endpoint SSRF (RUSTSEC-2026-0457 / GHSA-5p52-q7pq-9fq2, fixed in 3.7.0 via commit ac808abcb40d): When a remote MCP server returned Protected Resource Metadata naming an authorization server, rmcp (>= 2.0.0, < 3.7.0) checked only the literal host string in the metadata URL against private IP ranges and cloud metadata hostnames (metadata.google.internal). It never resolved DNS (so any attacker domain with an A record pointing to 127.0.0.1, 10.0.0.1, or 169.254.169.254 passed), matched on Url::host_str() which retained square brackets around IPv6 literals (http://[::1]:6379/ was not recognized as loopback), and did not check token_endpoint, registration_endpoint, or HTTP redirects at all. Commit ac808abcb40d adds a custom reqwest::dns::Resolve implementation (crates/rmcp/src/transport/auth/metadata_resolver.rs) that classifies every resolved SocketAddr (including NAT64 and IPv4-mapped IPv6 addresses) before dialing, derives the allowed address class strictly from the base MCP server URL literal, and validates every redirect and endpoint URL.
  • Unbounded ServerHandler::get_tool cache (RUSTSEC-2026-0461 / GHSA-4432-vg92-fqh6, fixed in 3.6.0 via PR #1349) and unbounded client HTTP response buffering (RUSTSEC-2026-0462 / GHSA-c9f9-cp8h-jcj5, fixed in 3.9.0 via commit 3e0156c1eaf1): On the server side (3.0.0 to 3.5.1), StreamableHttpService cached get_tool lookups in an unbounded process-wide map keyed by the incoming tools/call name during header validation, caching even unknown 4 MiB tool names on requests later rejected with HTTP 400. On the client side (0.2.0 to 3.8.0), both the reqwest and Unix-socket Streamable HTTP clients buffered non-streaming application/json and error response bodies in full without a byte cap, allowing a malicious MCP server to OOM-kill the host agent application during initialize by streaming infinite whitespace. Version 3.9.0 adds read_bounded_body() (crates/rmcp/src/transport/common/client_side_http.rs), capping JSON responses at 16 MiB and error bodies at 64 KiB after decompression.

3. Eclipse otterdog webhook eval() (CVE-2026-123870), @neo4j/graphql 7.6.7 (CVE-2026-92683), Apache Storm 3.1.0, and Axis2 2.0.2

  1. Eclipse otterdog unauthenticated GitHub webhook eval() RCE (CVE-2026-123870 / GHSA-32xf-7j44-xq72, CVSS 9.5 Critical, commit bbc9e3ced366): In otterdog/webapp/webhook/github_webhook.py, GITHUB_WEBHOOK_SECRET defaulted to None, causing _get_digest() to return None and _post_receive() to skip X-Hub-Signature verification whenever the secret was unset or empty. Immediately afterward, _log_event(event_type, data) interpolated the parsed JSON body into a format string and passed it to Python’s eval(): 
    --- a/otterdog/webapp/webhook/github_webhook.py
+++ b/otterdog/webapp/webhook/github_webhook.py
@@ -150,16 +150,16 @@ def _get_header(key):
 EVENT_FILTER = {
-    "workflow_job": "'{action}' == 'queued'",
-    "workflow_run": "'{action}' == 'completed'",
+    "workflow_job": lambda data: data.get("action") == "queued",
+    "workflow_run": lambda data: data.get("action") == "completed",
 }
 
 def _log_event(event_type, data) -> bool:
-    try:
-        return eval(EVENT_FILTER[event_type].format(**data))  # noqa: S307
-    except KeyError:
+    event_filter = EVENT_FILTER.get(event_type)
+    if event_filter is None:
         return True
+    return event_filter(data)
    Sending X-Github-Event: workflow_job with {"action": "' or __import__('os').system('...') or '"} executed arbitrary OS commands on the webapp server.
  2. Neo4j @neo4j/graphql 7.6.7 multi-condition @authentication bypass (CVE-2026-92683 / GHSA-58qp-3mmm-5vh8, CVSS 8.6 High, commit a077f3cdf38c): In packages/graphql/src/translate/authorization/utils/filter-by-values.ts, filterByValues() iterated over the key-value entries of a jwt where filter, but its generic-operator branch executed return filterByValuesOnGenericOperator(...) directly inside the for loop: 
    --- a/packages/graphql/src/translate/authorization/utils/filter-by-values.ts
+++ b/packages/graphql/src/translate/authorization/utils/filter-by-values.ts
@@ -31,12 +31,17 @@ export function filterByValues<T>(
             const { fieldName, operator } = parseFilterProperty(k);
             if (!operator) {
-                return filterByValuesOnGenericOperator({
-                    fieldName,
-                    receivedValues,
-                    jwtClaims,
-                    value: v as Record<string, any>,
-                });
+                if (
+                    !filterByValuesOnGenericOperator({
+                        fieldName,
+                        receivedValues,
+                        jwtClaims,
+                        value: v as Record<string, any>,
+                    })
+                ) {
+                    return false;
+                }
+                continue;
             }
    On any schema rule with two or more top-level JWT conditions (such as jwt: { iss: { eq: "https://idp.example.com" }, roles: { includes: "admin" } }), any valid JWT whose first field matched (iss) caused filterByValues to return true on the first iteration without ever checking roles.
  3. Apache Storm 3.1.0 (CVE-2026-82436, CVE-2026-82440) and Apache Axis2/Java 2.0.2 (CVE-2026-120761, CVE-2026-123753): In Storm 3.0.0, DefaultStateSerializer initialized Kryo with obj.setRegistrationRequired(false) and StdInstantiatorStrategy (Objenesis), allowing a co-tenant or network attacker who could write to the topology’s Redis state keyspace to plant an arbitrary Java object graph deserialized inside the worker JVM (commit 6d36a14d9e enables class registration via StateClassResolver), while Nimbus allowed topologies to instantiate any no-arg class on the Nimbus classpath (such as org.apache.storm.testing.InProcessZookeeper) when nimbus.scheduler.strategy.class.whitelist was unset (commit f6b7be390b). In Axis2 < 2.0.2, AxisService.createClientSideAxisService(URL) enabled javax.wsdl.importDocuments = true on wsdl4j, whose internal DocumentBuilderFactory lacked XXE protections when parsing <wsdl:import> and <xsd:import> targets (commit 1d3457d12399 disables remote WSDL imports by default and adds SecureWSDLLocator), and ResponseEndpointPolicy allowed non-anonymous WS-Addressing wsa:ReplyTo and wsa:FaultTo URLs by default (commit 1b6856b4d790 sets allowNonAnonymousResponseEndpoints = false by default).

IOCs

  • Airflow database and broker indicators:
    • Unexpected ExecuteCallback messages enqueued directly into Celery Redis/RabbitMQ queues without a corresponding Callback row in CallbackState.QUEUED (CVE-2026-68982).
    • XCom rows under skipmixin_key or past_depends_met containing "__classname__" serialization envelopes (CVE-2026-86829), or Variable/Connection lookups containing leading underscores (_<team>_<key>) in multi-team environments (CVE-2026-76185).
  • Eclipse otterdog and Axis2 request indicators:
    • POST requests to the otterdog GitHub webhook endpoint carrying X-Github-Event: workflow_job or workflow_run with quotes or Python expressions inside the JSON action field (CVE-2026-123870).
    • SOAP requests carrying non-anonymous <wsa:ReplyTo> or <wsa:FaultTo> headers (CVE-2026-123753) or WSDL documents with remote <wsdl:import> / <!DOCTYPE> declarations (CVE-2026-120761, CVE-2026-120832).

Detection and remediation

# 1. Check Python environments and lockfiles for apache-airflow, apache-airflow-task-sdk, and otterdog
pip show apache-airflow apache-airflow-task-sdk otterdog 2>/dev/null || true
rg -n '"?(apache-airflow|apache-airflow-task-sdk|otterdog)"?\s*([~=!<>]=|:)' \
  requirements*.txt pyproject.toml uv.lock poetry.lock 2>/dev/null

# 2. Check Rust Cargo.lock for rmcp, npm lockfiles for @neo4j/graphql, and Maven/Gradle for Storm and Axis2
rg -n -A 2 'name = "rmcp"' Cargo.lock 2>/dev/null
rg -n '"@neo4j/graphql"' package.json package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null
rg -n 'org\.apache\.(storm|axis2)' pom.xml build.gradle* 2>/dev/null
  1. Upgrade Apache Airflow to >= 3.4.0 and apache-airflow-task-sdk to >= 1.4.0: After upgrading, purge pre-upgrade audit-log rows (Log.extra) that recorded cleartext Connection, Variable, or CLI --conn-extra secrets (CVE-2026-50204, CVE-2026-86468) and rotate any credentials that were readable by low-privileged audit-log viewers or multi-team DAG authors (CVE-2026-76185, CVE-2026-107474). If you cannot upgrade immediately, set secrets.use_cache = False (for CVE-2026-76185) and load_examples = False (for CVE-2026-101031).
  2. Upgrade rmcp to >= 3.9.0 and @neo4j/graphql to >= 7.6.7: In @neo4j/graphql, review any @authentication directive that combines multiple conditions inside jwt: { ... } to determine whether non-admin token holders accessed protected queries prior to 7.6.7.
  3. Upgrade Apache Storm to 3.1.0 and Apache Axis2/Java to 2.0.2: When upgrading Storm to 3.1.0, register any custom state key/value classes in topology.state.kryo.register (CVE-2026-82436). On Axis2 deployments that cannot immediately upgrade to 2.0.2, set <parameter name="allowNonAnonymousResponseEndpoints">false</parameter> in axis2.xml.

Timeline

  • 2026-05-06 to 2026-08-29: Upstream fixes land in eclipse-csi/otterdog (bbc9e3ced366), apache/axis-axis2-java-core (1d3457d12399, 1b6856b4d790), apache/storm (6d36a14d9e, f6b7be390b), and apache/airflow (PR #71192, PR #72201).
  • 2026-10-15 to 2026-11-05: Neo4j commits a077f3cdf38c and releases @neo4j/graphql@7.6.7; modelcontextprotocol/rust-sdk merges commits ac808abcb40d (rmcp 3.7.0) and 3e0156c1eaf1 (rmcp 3.9.0).
  • 2026-11-06 (oss-security 2026/11/06/22 to 06/28): Apache announces the seven Axis2/Java 2.0.2 advisories on oss-security.
  • 2026-11-09 (05:02 to 11:17 UTC): Apache announces the two Storm 3.1.0 CVEs and 18 Airflow 3.4.0 CVEs on oss-security; NVD publishes CVE-2026-123870 (otterdog), CVE-2026-92683 (@neo4j/graphql), and the Axis2/Airflow/Storm CVEs; and RustSec assigns RUSTSEC-2026-0457, RUSTSEC-2026-0461, and RUSTSEC-2026-0462 to rmcp.

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Explore secrets scanning Get Demo

References