Publish Advisories

GHSA-2625-rw7m-5q5x
GHSA-26gq-p25f-99cp
GHSA-47w6-gwp4-w6vc
GHSA-c534-2w9c-x7fm
GHSA-f45q-w629-wr25
GHSA-g5vv-q72c-7j78
GHSA-qqc3-94qv-7fw3

Author: advisory-database[bot]

advisories/github-reviewed/2026/07/GHSA-2625-rw7m-5q5x/GHSA-2625-rw7m-5q5x.json

@@ -0,0 +1,66 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2625-rw7m-5q5x",
+  "modified": "2026-07-24T21:49:18Z",
+  "published": "2026-07-24T21:49:18Z",
+  "aliases": [],
+  "summary": "Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics",
+  "details": "## Summary\n\n`hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models.\n\n## Affected behavior\n\nNative `reqwest::Error` values retain the full request URL. Converting those errors into `ApiError::Http`, or exhausting retries and storing the error text in `ApiError::RetryExhausted`, preserves query parameter values. Detailed HTTP and decoding errors can retain server-provided messages, response bodies, or payload details, including through error source chains.\n\nSeveral public response and model types also derived or implemented diagnostics over untrusted or secret-adjacent fields. These include raw response bodies and cursors; rendered and JSON export payloads; import schemas and object data; task summaries, links, output URLs, events, and import-result details; event-delivery claims and errors; event sink configuration; subscription routing; and remote-call failure details. High-level backup and export runners additionally copied unsuccessful server task summaries into `ApiError::Api`.\n\nApplications commonly log errors and response values, so credentials, tokens, cursors, filters, echoed request content, imported object data, schema defaults, task or delivery details, and other sensitive payloads can be written to logs even though normal request logging redacts query values.\n\n## Remediation\n\nThe proposed fix redacts query values from embedded request URLs before storing native HTTP errors and applies the same sanitization to exhausted retries. Default error and model diagnostics now report safe metadata rather than server messages, payloads, cursors, links, configuration, or secret-adjacent details. JSON codec errors no longer appear in the standard source chain, and unsuccessful high-level backup/export operations use the structured `TaskUnsuccessful` variant without copying task summaries.\n\nExplicit response, error, task, import, export, event, and delivery APIs continue to expose original values for applications that deliberately inspect them.\n\n## Validation\n\nRegression coverage exercises direct HTTP conversion, async and blocking retry exhaustion, response and decoding diagnostics, import/export/raw-response containers, unsuccessful async and blocking task runners, task/event/import-result models, and secret-bearing event and remote models. The workspace format, lint, documentation, test, feature-matrix, Rust 1.88 MSRV, OpenAPI validation, release-metadata, and combined library plus consumer integration suites pass against the immutable Hubuum 0.0.3 image.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "hubuum_client"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.6.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.6.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-2625-rw7m-5q5x"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/hubuum/hubuum-client-rust"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hubuum/hubuum-client-rust/releases/tag/v0.6.1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-532"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-07-24T21:49:18Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/07/GHSA-26gq-p25f-99cp/GHSA-26gq-p25f-99cp.json

@@ -0,0 +1,71 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-26gq-p25f-99cp",
+  "modified": "2026-07-24T21:48:04Z",
+  "published": "2026-07-24T21:48:04Z",
+  "aliases": [],
+  "summary": "frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow",
+  "details": "## Summary\n\nAn integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire `frps` process with a single five-byte message. When the gateway parses an SSH `exec` channel request in `pkg/ssh/server.go`, it adds a small constant to a four-byte length value taken directly from the request. Because that length is fully attacker-controlled, a value of `0xFFFFFFFF` makes the addition wrap around to a tiny number, defeating the only bounds check and forcing an out-of-range slice. Go raises a panic that nothing recovers, so the whole server exits. In the default gateway mode SSH clients are not authenticated and the request is handled before any frp token is checked, so the crash is reachable pre-authentication. It carries no state and is trivially repeatable, turning one crash into a sustained outage that drops every tunnel for every user.\n\n## Details\n\nThe `exec` request payload is a four-byte big-endian length followed by that many command bytes, and the length field is fully attacker-controlled. The gateway computes the end of the command as `4 + length`. The constant `4` takes the `uint32` type of the length field, so `4 + 0xFFFFFFFF` wraps modulo 2^32 to `3`. The only guard compares the real payload size against this wrapped value, so a five-byte payload passes the test `5 < 3`, and the slice runs from index 4 to index 3:\n\n```go\n// pkg/ssh/server.go:315-319\nend := 4 + binary.BigEndian.Uint32(req.Payload[:4])  // 4 + 0xFFFFFFFF wraps to 3\nif len(req.Payload) < int(end) {                     // 5 < 3 is false, so it passes\n    continue\n}\nextraPayload := string(req.Payload[4:end])           // payload[4:3] -> panic\n```\n\nThe handler runs in a bare goroutine and no function in the call chain installs a `recover`, so the panic unwinds to the top of the goroutine and terminates the whole process rather than the single connection:\n\n```go\n// pkg/ssh/server.go:226\ngo s.handleNewChannel(newChannel, extraPayloadCh)    // no recover anywhere in the chain\n```\n\nThe sink is reachable without credentials in the default configuration. When no authorized-keys file is set, the gateway disables SSH client authentication, which is the default and documented mode where users authenticate through the frp token embedded in the SSH command. The `exec` request is processed during the channel phase, before that token is validated, so an unauthenticated peer reaches the sink:\n\n```go\n// pkg/ssh/gateway.go:74\nsshConfig.NoClientAuth = cfg.AuthorizedKeysFile == \"\"  // default: no client auth\n```\n\nAffected product: frp (fatedier), `frps` server, SSH Tunnel Gateway\nAffected versions: v0.53.0 (when the gateway was introduced) through v0.70.0, confirmed against a v0.70.0 build\n\n## PoC\n\nThe SSH Tunnel Gateway must be enabled with no authorized-keys file, which is the default mode of any deployment that turns the gateway on. No credentials and no knowledge of the target are required.\n\nEnable the gateway on a stock v0.70.0 build:\n\n```toml\nbindPort = 7000\n\n[sshTunnelGateway]\nbindPort = 2200\n```\n\nAs an unauthenticated SSH client, open a session channel and send one `exec` request whose four-byte length prefix is `0xFFFFFFFF` followed by a single byte, giving the five-byte payload `ff ff ff ff 41`. The server immediately panics and exits:\n\n```text\npanic: runtime error: slice bounds out of range [4:3]\n...github.com/fatedier/frp/pkg/ssh.(*TunnelServer).handleNewChannel\n    .../frp/pkg/ssh/server.go:319\n```\n\nThe shell prompt returns in the server terminal, confirming the whole process has terminated and every other client tunnel is dropped at the same instant. A well-formed request of the same length (prefix `1`) leaves the server running, proving the crash is caused by the overflow value and not by the `exec` request itself. The attacker can re-send the payload after any restart to hold the server down indefinitely.\n\n## Impact\n\nThis is an unauthenticated remote denial of service (CWE-190) leading to an out-of-range array index (CWE-129) and an unhandled process crash (CWE-755). A single five-byte, credential-free message kills the entire `frps` process. Because one `frps` commonly multiplexes the tunnels of many clients, the crash drops every active tunnel for every tenant at once and new logins are refused until the process is restarted, and re-sending the payload after each restart keeps the service down indefinitely (CWE-400). There is no confidentiality or integrity impact and no code execution.\n\nThis issue only affects frps instances with the SSH tunnel gateway explicitly enabled. The SSH tunnel gateway is disabled by default and is not commonly used in typical frps deployments. Default frps configurations are not affected.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/fatedier/frp"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.53.0"
+            },
+            {
+              "fixed": "0.70.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.70.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/fatedier/frp/pull/5428"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/fatedier/frp"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/fatedier/frp/releases/tag/v0.70.1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-129",
+      "CWE-190"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-07-24T21:48:04Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/07/GHSA-47w6-gwp4-w6vc/GHSA-47w6-gwp4-w6vc.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-47w6-gwp4-w6vc",
+  "modified": "2026-07-24T21:49:36Z",
+  "published": "2026-07-24T21:49:36Z",
+  "aliases": [],
+  "summary": "vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review",
+  "details": "### Impact\nEdit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. \n\nWorst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review\n\n### Patches\nNo\n\n### Workarounds\nNo",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "vantage6"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "5.0.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vc"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/vantage6/vantage6"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-863"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-07-24T21:49:36Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/07/GHSA-c534-2w9c-x7fm/GHSA-c534-2w9c-x7fm.json

@@ -0,0 +1,74 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c534-2w9c-x7fm",
+  "modified": "2026-07-24T21:47:17Z",
+  "published": "2026-07-24T21:47:16Z",
+  "aliases": [],
+  "summary": "Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources",
+  "details": "## Summary\n\nKite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters. Encoded path traversal segments can cause the upstream URL to resolve to a different Kubernetes API endpoint after authorization.\n\n## Impact\n\nAn authenticated user with `get` permission on pods or services in one namespace can cause Kite to issue GET requests to Kubernetes API endpoints outside that namespace using Kite's service account.\n\nWith Kite's default Helm RBAC configuration, this allows cluster-wide resource disclosure, including Secrets. The validated impact is confidentiality only; resource modification and denial of service were not demonstrated.\n\nDeployments using a restricted Kite service account are affected only up to the permissions granted to that service account.\n\n## Technical details\n\nThe authorization check is performed against the original namespace and kind route parameters. The proxy path is subsequently decoded and passed to `url.JoinPath`, which resolves `..` segments and can produce an upstream URL outside the authorized pod or service proxy prefix.\n\nTwo input locations were affected:\n\n1. Encoded traversal segments in the proxy catch-all path.\n2. Encoded traversal and slash characters in the resource name.\n\n## Reproduction\n\n\n1. Create a user with a role granting only `pods:get` in namespace `default`.\n2. Create any pod in `default` (e.g. `nginx`).\n3. Send the following request (auth cookie required):\n\n```bash\ncurl --path-as-is --cookie \"auth_token=<JWT>\" \\\n  'http://<kite-host>/api/v1/_clusters/<cluster>/namespaces/default/pods/nginx/proxy/%2e%2e/%2e%2e/%2e%2e/%2e%2e/kube-system/secrets'\n```\n\n## Patches\n\nFixed in Kite 0.14.1.\n\n- https://github.com/kite-org/kite/releases/tag/v0.14.1\n\n## Workarounds\n\nUpgrade to 0.14.1 or later.\n\nIf upgrading is temporarily impossible, reject encoded dot segments and encoded slashes at the reverse proxy and restrict Kite's Kubernetes service account permissions. Reverse-proxy normalization should not be treated as a permanent fix.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/zxh326/kite"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.6.9"
+            },
+            {
+              "fixed": "0.14.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.14.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/kite-org/kite/security/advisories/GHSA-c534-2w9c-x7fm"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kite-org/kite/pull/638"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kite-org/kite/commit/08116eed557f8d6982cc83af0b02991e0f3577d5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kite-org/kite/commit/69ad938937af8f375a2e183d1a331926ab851d98"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/kite-org/kite"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kite-org/kite/releases/tag/v0.14.1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-647"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-07-24T21:47:16Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/07/GHSA-f45q-w629-wr25/GHSA-f45q-w629-wr25.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f45q-w629-wr25",
+  "modified": "2026-07-24T21:48:36Z",
+  "published": "2026-07-24T21:48:36Z",
+  "aliases": [],
+  "summary": "Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects",
+  "details": "## Impact\n\nThe built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer `Authorization` header outside the configured Hubuum path prefix.\n\nExploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes.\n\n## Patches\n\nVersion 0.6.1 configures both built-in HTTP clients with `reqwest::redirect::Policy::none()`. Redirect responses are returned as 3xx API errors instead of being followed. Supplying a preconfigured reqwest client remains an explicit opt-in to that client's redirect policy.\n\n## Workarounds\n\nOn affected versions, construct a reqwest client with `reqwest::redirect::Policy::none()` and pass it through `with_http_client`. Deployments can also reduce exposure by ensuring the Hubuum origin is not shared with other applications and that trusted infrastructure never redirects API requests outside the configured path prefix.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "hubuum_client"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.0.1"
+            },
+            {
+              "fixed": "0.6.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-f45q-w629-wr25"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/hubuum/hubuum-client-rust"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-07-24T21:48:36Z",
+    "nvd_published_at": null
+  }
+}