Supply Chain · Watch Thursday · 10 September 2026 End-of-day synthesis 4 watches · 17 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Two rclone advisories disclosed after First Watch show its S3 and RC auth-proxy checks can be bypassed outright, escalating a day that already had an unauthenticated RCE in OmniRoute and two new MikroTik KEV entries.

Late escalation at 21:00 ET: two new critical advisories landed after First Watch locked in the day's shape, both in tools that sit directly in the auth path. rclone's second same-day batch included two auth-proxy bypasses — "rclone serve s3" without --auth-key accepts any SigV4 signature as valid, and a separate bug lets the RC interface's per-server auth-proxy config bleed across servers — while Traefik added an HTTP/3 backend NTLM connection-reuse bug to the header-alias fix already logged this evening.

The day's earlier shape holds otherwise. CISA added two MikroTik RouterOS bugs to KEV (argument-delimiter privesc, kernel-memory-disclosure DoS, both due September 13), and OmniRoute's custom-agent registration endpoint turned out to be unauthenticated RCE via a single crafted HTTP request. n8n and Open WebUI each picked up further same-day advisories tonight — Open WebUI's third batch adds an OAuth token-exchange bypass and an admin-demotion access-retention bug worth a manual check regardless of patch timing.

→ Operational priority for the night if you run rclone serve s3 or expose its RC interface, confirm --auth-key is set before anything else on this list — that's an unauthenticated-access bug discovered after most teams have gone home. Then work through OmniRoute (unauthenticated RCE), the RouterOS KEV deadline, and the Traefik, Open WebUI, and n8n upgrades before end of week.

21:00 ET · Last Watch

Critical · GHSA ·added 21:00 ET

Traefik's second same-day batch lands an HTTP/3 backend NTLM connection-reuse bug alongside a request-smuggling pair

Traefik's second same-day batch adds four more advisories on top of the header-alias/HTTP-3-timeout fix already logged tonight: an HTTP/3 backend can reuse an NTLM-authenticated connection across unrelated requests, letting one client ride another's negotiated auth state; a request-smuggling bug from inconsistent HTTP interpretation between Traefik and backends; a trailer-based bypass of entrypoint header-name sanitization; and a rootless-mode routing bug that forwards a literal "/" request-target verbatim instead of normalizing it. The NTLM connection-reuse bug is the one to treat as critical — connection-level auth reuse across requests is the same failure class as prior HTTP/1.1 connection-pooling auth leaks, and it's a same-vendor, same-day pattern alongside the smuggling bug. Upgrade past today's earlier fix release again; if you front NTLM-backed services through Traefik, audit for connection-pool sharing across tenants first.

Critical · GHSA ·added 21:00 ET

rclone ships nine advisories in one batch — the worst two mean "serve s3" and the RC interface authenticate nobody

rclone shipped nine advisories in one batch, the worst two collapsing its auth-proxy model: "rclone serve s3" run without --auth-key accepts any SigV4 signature as valid — full unauthenticated access to whatever rclone is fronting — and a second bug lets the RC (remote-control) interface's per-server auth-proxy configuration bleed across servers. An FTP cross-session backend-confusion bug and an S3 multipart memory-exhaustion DoS round out the highs; the remaining mediums are Zip Slip, symlink-based permission/attribute escapes, and a root-escape on upload. If you run rclone serve s3 or expose the RC interface beyond localhost, treat this as urgent — confirm --auth-key is set and patch before anything else in this batch.

High · GHSA ·added 21:00 ET

Open WebUI's third same-day batch adds an OIDC-fetch DoS and an admin-demotion bug that leaves access behind

Open WebUI's third same-day batch: an OAuth role-policy denial can still be bypassed via token exchange, an uncached OIDC fetch in the background scheduler lets an unauthenticated request stall the server, and three lower-severity bugs let any authenticated user suppress instance-wide calendar alerts, hang a request via a crafted folder-parent parameter, or — if demoted from admin via SSO role sync — keep read/write access to every user's data. Fifteen-plus advisories across three batches in one day confirms this is a full security release, not incremental fixes; fold these five into the same patch window as First Watch's upgrade. The admin-demotion access-retention bug is worth a manual check regardless of patch timing — verify no recently-demoted admin still holds broad access.

High · GHSA ·added 21:00 ET

@argos-ci/core: a CI branch name reaches a shell command unsanitized — OS command injection from a fork's branch name

@argos-ci/core resolves a CI branch name into a shell command without sanitization, so a pull request from an untrusted fork with a crafted branch name can achieve OS command injection on the CI runner. This is the same shape as the git-ref/branch-name injection bugs that have hit multiple CI tools this year — treat any CI integration that interpolates attacker-controlled ref or branch names into a shell command as guilty until proven innocent. Patch argos-ci/core and grep your own CI scripts for the same pattern.

High · GHSA ·added 21:00 ET

@jhb.software/payload-alt-text-plugin: missing authorization check on the alt-text endpoint

@jhb.software/payload-alt-text-plugin's alt-text generation endpoint is missing an authorization check, letting any authenticated Payload CMS user trigger it regardless of the collection or field it's bound to. Low blast radius on its own, but it's a template for auditing other Payload plugins that add custom endpoints — plugin authors don't reliably inherit Payload's field-level access control by default. Patch the plugin and spot-check other custom Payload endpoints for the same missing-authz pattern.

18:00 ET · First Watch

Critical · CISA KEV ·added 18:00 ET

CISA adds two MikroTik RouterOS bugs to KEV: an argument-delimiter privesc and an unauthenticated kernel-memory-disclosure DoS in btest

CISA catalogued two RouterOS CVEs today: CVE-2026-86060, an argument-delimiter injection that lets an attacker rewrite the trusted policy mask for privilege escalation, and CVE-2026-67277, a missing-authentication bug in the btest service that discloses kernel memory and enables denial of service. RouterOS runs internet-facing by default in a lot of small-ISP and branch-office gear that patches slowly, and both entries carry the same September 13 due date. Confirm RouterOS version and btest exposure on anything internet-facing — a policy-mask privesc plus a memory-disclosure primitive on the same platform, same day, is worth treating as a potential exploit chain until MikroTik's advisory says otherwise.

Critical · GHSA ·added 18:00 ET

OmniRoute's custom-agent registration endpoint is unauthenticated RCE — a single HTTP request runs code in the container

OmniRoute's POST /api/acp/agents endpoint accepts attacker-controlled binary and versionCommand fields for a custom ACP agent, then runs execFileSync on them during version detection with validation that only checks the first token matches — trivially satisfied by supplying node as the binary and a node -e "..." version command. When requireLogin=false, or during a fresh instance's unconfigured bootstrap window, anonymous requests are treated as authenticated, so this is unauthenticated RCE via a single HTTP request. If you run OmniRoute, confirm requireLogin is enabled and a management password is set before anything else, then patch.

High · GHSA ·added 18:00 ET

n8n's disclosure day keeps going: a second expression-sandbox escape headlines ten more same-day advisories

n8n shipped a second wave of same-day advisories on top of the OAuth/ReDoS/RCE batch already on today's list: another expression-sandbox escape via shared-builtin tampering (GHSA-6xcw-7xm6-48c6, legacy expression engine only) plus ten medium fixes spanning OAuth scope handling, an unvalidated AI-credential probe URL, a Git-node sandbox-path bypass, cross-tenant data exposure, credential decryption without ownership checks, dead-but-still-live OIDC SSO endpoints, a webhook signature-verification bypass, path injection into Elasticsearch nodes, workflow-summary prototype pollution, and an anonymous approval-gate bypass. Fifteen advisories from one vendor in a single day is itself the signal — treat this as a full n8n security release, not incremental patches. Upgrade to 1.123.76 / 2.37.7 / 2.38.2 or later; if you can't yet, set N8N_EXPRESSION_ENGINE=vm to close the sandbox escape.

High · GHSA ·added 18:00 ET

Open WebUI adds two more same-day advisories: a cross-tenant session-cookie leak to tool servers and a sign-in-as-anyone OAuth bug on SQLite

Two more Open WebUI advisories landed beyond today's eight-bug batch: a cookie-jar handling bug that sends a user's live session cookie to whichever external tool server was processed last when multiple tool servers are attached to one request, and — on the default SQLite backend — an OAuth/SCIM subject-claim lookup that does a substring match instead of exact match, letting a crafted or coincidental claim value bind sign-in to a different, possibly administrative, account. Ten Open WebUI advisories in one day is the same signal as n8n's: budget for a full-instance upgrade, not a single-CVE patch. Postgres deployments are unaffected by the sign-in bug; SQLite deployments running OAuth/OIDC or SCIM should upgrade immediately and audit recent sign-ins for account mismatches.

High · GHSA ·added 18:00 ET

mistral.rs, a Rust LLM inference server, ships unbounded media-fetch DoS and SSRF-plus-local-file-read in the same code path

mistral.rs's OpenAI-compatible chat-completions endpoint fetches attacker-supplied image/audio/video URLs into server memory with no byte cap and no host allowlist, and separately treats file:// URLs and bare local paths in image_url/audio_url fields as fetchable — the same parsing path yields both a memory/CPU exhaustion DoS and unauthenticated SSRF plus arbitrary local file read. Neither bug requires credentials; the endpoints are open by default, so any exposed mistral.rs instance accepting multimodal input is reachable from the internet. Patch, and in the meantime put an egress allowlist or proxy in front of any deployment that accepts external image, audio, or video URLs.

High · GHSA ·added 18:00 ET

Angular SSR ships four advisories: an XSS breakout via <template> boundary handling and a Unicode-whitespace SSRF lead the batch

Two high-severity SSR bugs: unescaped closing tags inside a <template> nested in a fallback raw-content element let attacker content break out of the fallback container and execute as live DOM, because the serializer's ancestor walk stopped at the DocumentFragment boundary and never saw the enclosing <noscript>/<iframe>; and a Unicode-whitespace discrepancy between WHATWG URL parsing and Angular's trim()-based URL resolution lets a same-origin-looking URL resolve cross-origin during SSR, leaking Authorization headers via SSRF. Two mediums round out the batch: an HttpTransferCache bypass that can leak authenticated responses to anonymous hydration requests under withRequestsMadeViaParent(), and a directive host-binding sanitization gap that skips URL sanitization when a directive is applied to a different concrete element than the compiler assumed. If you render untrusted content via SSR or attach credentials to HttpClient requests validated by same-origin checks, upgrade to 22.1.0 / 21.2.20 / 20.3.28 or later.

High · GHSA ·added 18:00 ET

Pimcore Custom Reports: SQL injection via a trivially-bypassed keyword blacklist

Pimcore's Custom Reports bundle concatenates report-configuration fields (sql, from, where, groupby) directly into queries, protected only by a regex blacklist against ALTER/CREATE/DROP/RENAME/TRUNCATE/UPDATE/DELETE — it doesn't block INSERT, UNION SELECT, LOAD_FILE(), INTO OUTFILE, or comment-based injection, so an authenticated user with reports_config permission can read, modify, or delete the entire database. This is permission-gated rather than unauthenticated, but reports_config is a low bar in many Pimcore deployments compared to full admin. Patch to 2026.1.6 / 12.3.10 / 11.5.19, or in the meantime restrict reports_config to trusted admins and put a WAF rule on the custom-report update endpoint.

Medium · GHSA ·added 18:00 ET

Traefik ships two medium hardening fixes: a header-alias identity-spoofing bypass and unbounded HTTP/3 request bodies

A dot-form header alias (X.Authenticated.User next to Traefik's canonical X-Authenticated-User) lets a client smuggle a spoofed identity past ForwardAuth to backends that collapse dots and dashes into the same variable name — the same bug class as a prior underscore-only fix, now closed via the new aliasHeadersStrategy option (default keep; set to delete or reject to take effect). Separately, respondingTimeouts.readTimeout has silently not applied to HTTP/3 since v2.8.2, so a client trickling a request body can hold a QUIC-backed upstream connection open indefinitely at near-zero cost. Upgrade to v2.11.56 / v3.7.12 and explicitly set aliasHeadersStrategy — the default doesn't change behavior for existing configs.

12:00 ET · Forenoon Watch

High · GHSA ·added 12:00 ET

n8n ships four same-day advisories: OAuth domain bypass, ReDoS, storage exhaustion, and an expression-sandbox RCE

n8n disclosed four vulnerabilities together: a domain-restriction bypass in the OpenAI Chat Model node's model-search endpoint, a ReDoS in the Git node's default blocked-file-pattern match, unauthenticated persistent storage exhaustion via the OAuth dynamic-client-registration endpoint, and an expression-sandbox escape via class-field sanitizer rebinding that reaches code execution. The sandbox escape is the one that matters — n8n's expression editor exists to let workflow authors run limited JS, and a rebinding bypass turns that boundary into full RCE on the workflow-execution host. Patch n8n to the fixed release and audit any self-hosted instance that lets external users author workflows or register OAuth clients.

High · GHSA ·added 12:00 ET

Open WebUI ships eight same-day advisories, the worst a same-origin XSS to account takeover via the terminal port-preview iframe

Open WebUI disclosed eight vulnerabilities in one batch: account-takeover XSS via a hardcoded allow-same-origin sandbox on the terminal port-preview iframe, SSRF into internal services via DNS rebinding in the Playwright web loader, an SSRF-reachable Azure platform channel, an OAuth domain-allowlist bypass via token exchange, and four lower-severity access-control bugs around knowledge bases, chat folders, and message edits. The XSS-to-takeover and the two SSRF paths are worth acting on first — each lets a standard authenticated user, or in the XSS case a crafted page, cross a trust boundary Open WebUI's network and admin isolation depends on. Patch to the fixed release and check whether internal services are reachable from wherever the Playwright loader runs before assuming SSRF isn't exploitable in your deployment.

High · GHSA ·added 12:00 ET

Excelize ships two parsing bugs: attacker-controlled allocation in streaming GetRows, and a panic on malformed shared-string index

Excelize's streaming GetRows bypasses its own row-bound checks, letting a crafted spreadsheet drive attacker-controlled memory allocation; a second bug panics GetCellValue and GetRows on a negative shared-string index. Any service parsing user-uploaded XLSX files with Excelize's streaming reader is exposed to both a DoS-by-allocation and a DoS-by-crash from the same untrusted-input class. Update Excelize and don't feed it uploaded spreadsheets without a size or memory ceiling in front of the parse.

High · GHSA ·added 12:00 ET

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family names

The React docx-editor component embeds font-family names from document content into generated CSS without escaping, so a crafted font name in an uploaded .docx becomes CSS injection and, at print time, XSS in the viewing browser. This is a supply-chain-relevant one for anyone embedding user-uploaded Office documents in a web viewer — the attack surface is the document content itself, not the upload mechanism. Update the package and treat font metadata pulled from user-supplied documents as untrusted before it reaches a stylesheet.