DEV Community: threataft

GitLab's CI/CD Regex Compiler Has a CVSS 10.0 — and It's Being Exploited Right Now

threataft — Sun, 01 Nov 2026 09:33:47 +0000

If you run GitLab — self-hosted or managed — this one matters.

CVE-2026-97229 is a CVSS 10.0 integer overflow in GitLab's CI/CD regex compiler.
An unauthenticated attacker sends a crafted regex pattern in a pipeline
definition. The compiler overflows, corrupts the heap, and execution follows.
No login required. No pipeline needs to run.

CISA added it to the Known Exploited Vulnerabilities catalog with a remediation
deadline of November 1, 2026. Active exploitation confirmed against Alpine Linux
infrastructure.

What makes this different from most CVEs:

The attack surface is a .gitlab-ci.yml file — something every developer on
your team touches. On a self-hosted instance, anyone who can submit a merge
request can trigger it. On a public project, that's anyone on the internet.

The fix exists: GitLab 17.8.1.

If you're running anything below that, you're exposed. The patch ships with
GitLab 17.8.1 and later. Self-hosted admins need to update manually —
GitLab.com was patched by the vendor.

If you can't patch immediately:

Disable public project creation
Restrict who can submit merge requests on public repos
Watch for unusual CI job failures or unexpected process spawns from the runner

I wrote a full technical breakdown covering the integer overflow mechanism,
the heap corruption path, exploitation against Alpine, and the KEV timeline:

👉 https://threataft.com/articles/gitlab-cve-2026-97229-regex-rce

Cross-posted from ThreatAft with canonical URL set to the original.

GitLab CVE-2026-97229: Integer Overflow in the Regex Compiler, CVSS 10.0, Exploited in the Wild

threataft — Sat, 31 Oct 2026 02:43:59 +0000

Body:

A CVSS 10.0 in GitLab’s CI/CD regex compiler — and the October 12 patch isn’t enough.

CVE-2026-97229 is an integer overflow (CWE-190) in Onigmo, Ruby’s regex engine. A crafted pattern in .gitlab-ci.yml triggers an overflow in the compiler’s program-size arithmetic, producing invalid bytecode that executes as the git OS account — the account that owns every repo, CI variable, and deployment key on the instance.

What you need to know:

Rapid7 published a working PoC the day after the patch
Alpine Linux was attacked 8 days later — worker crashed 8 times, attacker downloaded the container image to tune the exploit
CISA added it to KEV (federal deadline: Nov 1)
The Oct 12 releases (19.4.2/19.3.5/19.2.8) don’t cover CVE-2026-110264 — a second regex flaw in the same engine. You need 19.4.3/19.3.6/19.2.9 (Oct 21)
Source and custom-image installs also need Ruby 3.3.13, 3.4.12, or 4.0.9 — GitLab’s version doesn’t proxy the Ruby runtime

Detection hint: repeated Puma worker crashes in a short window are the only reliable artefact of a failed exploit attempt.

Full technical breakdown including the PR:N controversy, Alpine Linux incident timeline, and mitigation checklist:

threataft.com

CVE-2026-111585: The TeamViewer Host Attacks the Viewer — and the Viewer Is the IT Technician

threataft — Fri, 30 Oct 2026 16:25:07 +0000

Most remote-access security advice is written for one direction.
Protect the host. Verify the caller. Don't let strangers in.

CVE-2026-111585 runs the other way.

The host attacks the viewer. The malicious machine is the
one being supported. The target is the support technician's
own workstation.

What happens

The TeamViewer protocol lets the host declare its screen geometry.
The viewer allocates a decompression buffer from those dimensions
— with no upper bound on what arrives over the network.

A host that declares 32768 × 32768 pixels at 32bpp overflows
a 32-bit integer. The allocation wraps. Every row past the
thirty-first is written out of bounds.

The host also controls what gets decompressed into that buffer.
Same attacker, both sides of the write.

The part that makes it deterministic

The vulnerable path only activates when hardware video decoding
isn't available. But the host can refuse codec negotiation,
forcing the viewer onto software decompression.

The victim's client doesn't choose the path. The attacker's
machine does.

Researcher Remedio traced the path to WinExec in the viewer
process.

Why CVSS 8.8 undersells this

The vector says UI:R — user interaction required.

The interaction is: establish a remote-control session to the host.

For a helpdesk doing 40 sessions a day, that's Tuesday.

The attacker doesn't even need to own the target machine.
A compromised host is enough — any infected endpoint that
later opens a support ticket becomes the delivery mechanism.

If the viewer is compromised, the attacker inherits everything
it can reach: RMM platform, password vault, standing admin
sessions into every customer environment.

The blast radius is the client list.

Same bulletin, two more flaws

TV-2026-1011 also covers:

OOB write in the screen-image decoder (Linux, macOS) — reachable via a crafted .tvs session recording. No live session needed.
macOS LPE to root — TOCTOU race in the privileged helper, local low-privileged attacker reaches root.

All three fixed in 15.83.

Fix

Branch	Fixed build
Current	15.83
15.64 (Win 7/8)	15.64.10
14.7	14.7.48868
13.2 (Win)	13.2.36231
13.2 (Linux)	13.2.154008
13.2 (macOS)	13.2.154007

Don't forget Portable installs — they don't appear in
software inventory and are the ones most likely to be missed.

Treat .tvs session recordings as executable content.

Full breakdown including detection guidance and the full
bulletin analysis:
👉 https://threataft.com/articles/teamviewer-cve-2026-111585-viewer-heap-overflow-screen-decompression

Cisco SD-WAN CVE-2026-20127 — A CVSS 10.0 Auth Bypass, a Key-Stealing Implant, and a Relay Network Built to Disappear

threataft — Fri, 30 Oct 2026 13:28:27 +0000

Cisco Catalyst SD-WAN controllers carry a CVSS 10.0 authentication bypass (CVE-2026-20127) that was exploited before disclosure — and continued after. Attackers used it to install KeyDrift, a two-component implant that hooks into the controller's key-management process and extracts AES-256 traffic keys after decryption.

The second finding came from Lumen's Black Lotus Labs: Silent Train, Volt Typhoon's relay network of compromised SOHO routers and IoT devices, rotated per session and cleaned up afterward. Cisco Talos assesses with high confidence that the infrastructure behind KeyDrift overlaps considerably with Silent Train.

What KeyDrift Does

KeyDrift doesn't break AES-256. It sits inside vdaemon — the legitimate process that handles SD-WAN's encrypted control sessions — and reads the keys after the controller decrypts them.

LittleFilch hooks SSL_read, extracts 32-byte AES-256 keying material for a predefined list of edge nodes, RSA-encrypts it, and stages it for UDP exfiltration
PolyFlame is the backdoor — memory-resident, no hardcoded C2 address, accepts commands hidden inside SD-WAN control traffic

Persistence is via modified runit service scripts. On Validators, a fake compiled aaamgrd service (Cisco's real one is a Python package) loads PolyFlame into memory.

Two 10.0s, Three Months Apart

CVE	Disclosed	Actor	Fixed
CVE-2026-20127	Feb 25, 2026	UAT-11473	20.9.8.2 / 20.12.5.3 / 20.12.6.1 / 20.15.4.2 / 20.18.2.1
CVE-2026-20182	May 2026	UAT-8616	Same trains

Rapid7 found the second while investigating the first. A fix for one didn't close the class.

What to Hunt

Modified runit scripts under /etc/sv/sshd/run
Fake aaamgrd service at /etc/sv/aaamgr/ on Validators
/tmp/system-vdaemon (loader artifact)
Unknown peer IPs in WebUI → Devices → System IP
Outbound UDP to addresses not in your configuration
NETCONF changes without a change ticket

Patching closes the entry point. It does not remove an implant already running in memory.

The Attribution Call

Talos says: high confidence infrastructure overlap between UAT-11473 and Silent Train. It explicitly does not say the actors are identical. That is the correct level of assertion for relay-network analysis — and it doesn't change the remediation either way.

Full breakdown including detection indicators, version table, and mitigation checklist:
https://threataft.com/articles/cisco-sd-wan-cve-2026-20127-volt-typhoon-silent-train-keydrift

17 CVEs across 12 AI agent frameworks — one disclosure wave, same three design failures.

threataft — Tue, 20 Oct 2026 11:27:25 +0000

6× CVSS 9.8 unauthenticated RCE:

Piflow: POST /chat → exec_shell, no auth
Langchain-Chatchat: /tools/call invokes shell tool, no auth
DB-GPT: mock auth grants everyone admin
Letta: compose.yaml omits LETTA_SERVER_SECURE, all routes open
Cognition: no auth on REST/SSE API (fixed: 0.13.0)

5× 8.8: approval gates return True, unsandboxed python3, async sub-agents skip interrupt_on.

2× 8.3 IDOR: IBM Langflow OSS (fixed: 1.12.5), Coze Studio (fixed: 0.5.2).

7 products have no published fix. Put an auth proxy in front, bind DB ports to localhost, and rotate every secret in the execution environment.

https://threataft.com/articles/ai-agent-framework-rce-mega-cluster-17-cves

Splunk Patched an Unauthenticated RCE in Its Own SIEM — Here's What You Need to Know

threataft — Thu, 08 Oct 2026 05:26:16 +0000

An unauthenticated attacker with network access to a Splunk search head cluster member can execute arbitrary OS commands. No credentials. No interaction.

CVE-2026-76268 | CVSS 9.1 | Affects 10.4.x and 10.2.x only

What's vulnerable

Splunk Enterprise ships with Patroni — a PostgreSQL high-availability tool — running a REST API on search head cluster members. That API has no authentication on critical operations. Network access is enough.

Affected: 10.4.0–10.4.2 and 10.2.0–10.2.6.
Not affected: 10.0.x and 9.4.x.

Why a SIEM RCE is especially bad

A compromised Splunk deployment isn't just a breach — it's a blind spot. Attackers with command execution on a search head can:

Suppress or delete alerts
Modify detection rules and saved searches
Exfiltrate every log your org has shipped to Splunk
Pivot to other systems via Splunk's broad network access

The workaround (if you can't patch yet)

An unauthenticated attacker with network access to a Splunk search head cluster member can execute arbitrary OS commands. No credentials. No interaction.

CVE-2026-76268 | CVSS 9.1 | Affects 10.4.x and 10.2.x only

What's vulnerable

Affected: 10.4.0–10.4.2 and 10.2.0–10.2.6.
Not affected: 10.0.x and 9.4.x.

Why a SIEM RCE is especially bad

A compromised Splunk deployment isn't just a breach — it's a blind spot. Attackers with command execution on a search head can:

Suppress or delete alerts
Modify detection rules and saved searches
Exfiltrate every log your org has shipped to Splunk
Pivot to other systems via Splunk's broad network access

The workaround (if you can't patch yet)

Set disabled = true in the [postgres] stanza of $SPLUNK_HOME/etc/system/local/server.conf, then restart Splunk.

Only safe to do if you're not using Edge Processor, OpAmp, or SPL2 data pipelines. If you are — patch first, no workaround.

The rest of the disclosure

17 CVEs total across all four branches (10.4, 10.2, 10.0, 9.4):

CVE-2026-76266 (7.7) — local user runs commands as Splunk service account on Linux → loads attacker-controlled shared library → privilege escalation
CVE-2026-76270 (6.5) — SQL injection in SPL2 module filtering, 10.4 only
CVE-2026-76274 (6.5) — SSRF in Splunk App for Observability Cloud → leaks API token
CVE-2026-76286 (5.3) — SSRF in Splunk MCP Server leaks auth token to attacker-controlled host

Fixed versions: 10.4.3, 10.2.7, 10.0.10, 9.4.15

Quick checklist


bash
# Check your version
splunk version

# Apply workaround if not on 10.4/10.2 with pipelines in use
echo "[postgres]
disabled = true" >> $SPLUNK_HOME/etc/system/local/server.conf
splunk restart

 https://threataft.com/articles/splunk-mass-disclosure-cve-2026-76268-patroni-rce

Cisco Dropped 18 CVEs Yesterday — Here's What Actually Needs Your Attention

threataft — Thu, 08 Oct 2026 05:24:45 +0000

Seven critical CVEs across two product lines. None exploited yet. No workarounds exist. Here's the fast triage.

NX-OS NGOAM — 3 × CVSS 9.8 Unauthenticated RCE

CVE-2026-76485, CVE-2026-76486, CVE-2026-76501

Affects: Cisco Nexus 3000 and 9000 Series switches

The NGOAM (VXLAN OAM) feature has improper input validation on IP traffic. Crafted packets → root code execution, no auth required. Each CVE has slightly different feature prerequisites:

CVE	Requires
CVE-2026-76485	NGOAM + SRv6 OR NV Overlay
CVE-2026-76486	NGOAM + NV Overlay + at least one peer VTEP
CVE-2026-76501	NGOAM + SRv6 (Nexus 9000 only — 3000 doesn't support SRv6)

Check your exposure right now:


bash
show feature | include ngoam
show feature | include nve
show feature | include srv6

CVE-2026-94293: AAS Edge Client — CVSS 9.8 IIoT Data Tampering, No Patch, Decommission Now

threataft — Tue, 06 Oct 2026 11:30:29 +0000

CVE-2026-94293 (CVSS 9.8) — Murrelektronik's Software AAS Edge Client exposes an unauthenticated REST API on TCP port 18000 bound to all interfaces. Any network-reachable attacker can read all AAS submodel data via GET and overwrite it via PATCH — no credentials, no user interaction, no exploit code required.
Modified data propagates to central AAS servers, extending impact downstream. CORS is unrestricted, so browser-based attacks work too.
No patch. Vendor has archived the repositories and recommends decommissioning.
The practical risk: this was a trade-fair demonstrator, so it may be running in environments where it was never formally inventoried. Check containers and edge deployments.
Full analysis → https://threataft.com/articles/aas-edge-client-cve-2026-94293

HyperShift CVE-2026-101919 — CVSS 8.8 Tenant Isolation Bypass via Kubeconfig Passthrough

threataft — Tue, 06 Oct 2026 01:55:30 +0000

An authenticated tenant with basic namespace permissions can break out to the host control plane in OpenShift clusters running Multicluster Engine with HyperShift.

CVE-2026-101919 (CVSS 3.1 8.8, Red Hat: Important) is an improper input validation flaw in the hypershift-rhel9-operator. The ReconcileCredentials function copies a user-provided kubeconfig Secret verbatim into the privileged control plane namespace:

// illustrative — simplified from source
for k, v := range sourceSecret.Data {
targetSecret.Data[k] = v
}

No exec-provider stripping, no AuthProvider validation, no InsecureSkipTLSVerify guard. A tenant embeds a malicious exec plugin in their kubeconfig → operator copies it to the control plane namespace → downstream controller (CAPK) consumes it → plugin executes with control plane privileges.

Impact:

Arbitrary code execution in the control plane namespace
Access to all control plane secrets
Lateral movement across tenant boundaries
Tenant isolation guarantee defeated

No public PoC. Patch is available.

Immediate mitigations:

Patch the HyperShift operator via your cluster update mechanism
Restrict Secret creation to trusted accounts in HyperShift-watched namespaces
Deploy admission webhook to reject kubeconfig Secrets containing exec plugins
Audit existing kubeconfig Secrets for embedded plugins

Full analysis: https://threataft.com/articles/hypershift-tenant-isolation-bypass-cve-2026-101919

Legcord (Discord Client) — 2 CVEs: XSS in Discord Page Becomes RCE + Persistent Traffic Interception

threataft — Mon, 05 Oct 2026 13:08:04 +0000

If you use Legcord as your Discord client, a script running in the Discord page can break out of the Electron sandbox entirely.

CVE-2026-105293 (CVSS 8.1) — Path Traversal to RCE
Theme IPC handlers (themes.install, themes.uninstall, themes.folder) accept identifiers without sanitizing ../ sequences. Discord-origin script passes a traversal payload → writes arbitrary files, deletes directories, or launches local executables outside the themes directory.

CVE-2026-105294 (CVSS 7.4) — Config Injection → Persistent MITM
window.legcord.settings.setConfig has no allowlist. Script sets additionalArguments to --proxy-server=attacker-host --ignore-certificate-errors. Persists to disk. Every subsequent Legcord launch routes all traffic through the attacker's proxy with TLS validation silently disabled.

Both require Discord-origin XSS first — not drive-by, but chain-dependent exploitation is realistic.

No confirmed fixed version as of publication. Upgrade past 1.3.0 and check your config for injected proxy switches.

ZITADEL Cluster: 7 CVEs, Peak CVSS 9.3 — Cross-Org Account Takeover via Passkey Enrollment

threataft — Mon, 05 Oct 2026 06:29:51 +0000

An attacker with minimal write permissions in one ZITADEL organization can take over accounts in another. CVE-2026-105209 (CVSS 9.3) lets them forge the x-zitadel-orgid header to issue passkey enrollment codes for users in any other org — then register their own authenticator.

Two more critical paths in the same cluster:

CVE-2026-105215 (9.1) — account pre-hijacking via forged IdP callback fields (no auth required)
CVE-2026-105211 (8.1) — OTP codes leaked in Login V2 server-action responses, MFA bypassed
CVE-2026-105210 (8.8) — 2FA enrollment bypass in Login V1
CVE-2026-105208 (7.7) — session hijacking via malleable IdP intent token encryption

Fix: upgrade to 4.17.3 (4.x) or 3.4.15 (3.x). Then audit cross-org passkey enrollments and rotate admin credentials.

Full breakdown: https://threataft.com/articles/zitadel-cluster-cve-2026-105209-105215-105211-105208-105206-105210-105213

CVE-2026-88779 — Citrix NetScaler SAML Memory Overflow, Actively Exploited, CISA KEV

threataft — Mon, 05 Oct 2026 01:52:18 +0000

A memory overflow in Citrix NetScaler's SAML handler is being actively exploited as a zero-day. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog on October 4, 2026.

CVE-2026-88779 (CVSS 4.0: 8.7) — Unauthenticated memory overflow (CWE-119) triggered by malicious SAML requests. Crashes the appliance's authentication service, denying VPN and SSO access to the entire organization. Citrix confirms DoS; Norway's NSM initially reported potential RCE — scope remains contested.

If either returns results and you're below the fix versions, patch now.

Fixed in:

14.1-73.41 (14.1 track)
13.1-64.28 (13.1 track)
14.1-73.41 FIPS / 13.1-37.282 (FIPS/NDcPP)

Kevin Beaumont observed exploitation on honeypots running fully patched versions — the exploit may bypass the previous patch batch.

Immediate actions:

Patch to fixed version
Apply Citrix Global Deny List signatures as interim mitigation
Check for appliance crashes during the zero-day window
Run compromise assessment on any internet-exposed SAML-enabled appliance

Full analysis: https://threataft.com/articles/netscaler-saml-memory-overflow-cve-2026-88779