sep 3, 2026
10 links from the engineering internet.
workerd v1.20260903.1 calls the authorizer in default column expressions
the workers runtime now runs default column expressions through the authorizer instead of around it. the same build retries replica actor fetches while counting each retry once, and adds span.recordexception to its tracing spans.
misp ldap and linotp logins accept an empty password
misp's custom auth handlers skipped checks cakephp's formauthenticate does, so a directory allowing unauthenticated binds returns success for a valid dn and a blank password. ldap-provisioned accounts also carry empty-password hashes the local fallback matches.
taipy serves socket.io with wildcard cors and credentials enabled
any web page can open a credentialed websocket to a taipy app and drive state variable changes and action callbacks with no csrf protection. the config sits in taipy/gui/server.py and rates 9.3.
cat signs session cookies with java's string.hashcode
dianping's cat monitoring system uses an unkeyed hashcode as the only cookie integrity check, so an admin session can be forged offline. an x-forwarded-for header defeats the ip binding meant to contain it.
ollama follows registry redirects to arbitrary hosts on model pull
a malicious registry manifest points tensor-layer blob downloads anywhere, turning an ollama server into an unauthenticated ssrf probe against internal infrastructure and cloud metadata endpoints.
label studio presigns storage uris across organization boundaries
proxy_api.py endpoints resolve cloud storage uris without checking org membership. a low-privilege user registers their own org, hands over another tenant's file uri, and streams the bucket contents back. affects through 1.23.0.
dbgate jslid parameter resolves file:// paths outside its directory
getjslfilename() never sanitizes jslid, so any authenticated user reads and writes arbitrary files through the jsldata controller, including the encrypted database credentials in saved connections. affects through 7.2.6.
kill bill leaves permission annotations off three adminresource endpoints
getqueueentries, invalidatescache and putoutofrotation ship without enforcement, so an account:read user can read internal queues, flush caches, and pull the host out of rotation. affects through 0.24.21.
eclipse aerios 1.2.1 patches an unauthenticated path traversal
the self-orchestrator built filesystem paths from unsanitized rest identifiers, letting anyone write or delete json files outside the intended directories. the container running privileged made it worse. fixed by sanitizing path separators.
mongodb c driver writes past the heap on truncated bson-to-json
encoding a binary field while the output buffer is capped at a caller-supplied length writes a few bytes past the end of the allocation. attacker-supplied bson content reaches it with no privileges required.