CVE Vulnerability Catalog

A vulnerability in Anagnorisis (up to 0.3.1/0.4.0) in the Socket.IO Connect Interface component (app.py) causes missing authentication. The attack can be launched remotely, and the exploit is public. The vendor did not respond.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an installation using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing assigned requests to fail. Continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocols are not affected.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, a SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. It also does not record already accepted assertions, allowing replay. An unauthenticated actor possessing a valid assertion can use it to authenticate as the user named in the assertion. Only SAML Sources are affected.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, API serializers return stored credentials when an account has view permission on an affected configuration, even without authorization to change it or read secrets. Affected configurations include one-time code delivery, outbound provisioning, device trust, identity sources, Kubernetes outpost, and applications using secrets. Deployments are at risk when view permission is granted to accounts not intended to read these credentials.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status or assign an existing role to a group without holding the required permissions. Group hierarchy checks do not consistently account for inherited superuser status, and role assignment to a group lacks authorization checks.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the established address. An attacker who knows the target's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. Successful enrollment gives the attacker a session as the target and access to SSO applications.

In the Linux kernel's stmmac network subsystem for XGMAC2, the RBUE (RX Buffer Unavailable) interrupt was enabled by default, causing a MAC interrupt storm under heavy RX load. The fix disables RBUE in the default interrupt mask because it is redundant—the normal RIE interrupt already triggers NAPI and refills descriptors. This prevents the storm while maintaining normal RX handling.

In the Linux kernel virtio-fs, virtio_fs_setup_vqs() frees fs->vqs and fs->mq_map on the error path, then virtio_fs_ktype_release() frees them again, causing a double-free and dangling pointers. The fix sets the pointers to NULL after kfree() so the later release is harmless. This can be triggered when a broken virtio-fs device advertises more request queues than the transport provides.

In the Linux kernel HID hidpp driver, if input_register_device() fails, input_free_device() is called but a stale pointer to the old device remains in hidpp->input, potentially leading to a use-after-free. The fix resets it to NULL before returning from hidpp_connect_event().

In the Linux kernel, the perf subsystem uses event::addr_filter_ranges under RCU but does not free it via RCU. The incorrect object lifetime can lead to memory errors.

In the Linux kernel, the f2fs filesystem's inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore cause the conversion path to read past the inline filename storage.

A flaw was found in the Linux kernel's btrfs module in the validation of the INODE_REF name length (namelen). A crafted btrfs image can contain a namelen larger than the 255-byte limit, causing an out-of-bounds write and a kernel panic.

In the Linux kernel, a double fput() occurs in the error handling of cachefiles_create_tmpfile() in the cachefiles subsystem. This leads to incorrect release of a file reference.

In the Linux kernel, the wifi cfg80211 subsystem's cfg80211_rx_assoc_resp() initializes the status and response-IE fields from the management frame before proving the frame is long enough for those offsets. The S1G path only patches resp_ie after the unsafe initializer has already run.

In the Linux kernel, the SMB client's stack-allocated cifs_open_info_data structure may contain random data, which can cause fields to have incorrect values if they are not set later.

In the Linux kernel iwlwifi driver (mvm subsystem), the sta_id in the BA_WINDOW_STATUS_NOTIFICATION_ID notification is not validated before being used as an index into the fw_id_to_mac_id[] array, leading to potential out-of-bounds access.

In the Linux kernel btrfs filesystem, merge_reloc_roots() has an issue with reloc root cleanup: when a root has zero references, the reloc_root pointer is reset without memory barriers, and the BTRFS_ROOT_DEAD_RELOC_TREE flag is cleared incorrectly. The fix uses clear_reloc_root() to ensure proper synchronization.

In the Linux kernel iwlwifi driver (pcie subsystem), after a failed TX init, the RX resources are freed but the pointers are not set to NULL. This can lead to use-after-free during later cleanup or retry.

In the Linux kernel iwlwifi driver (mvm subsystem), TX_CMD response parsing does not validate the response layout correctly. The minimum length check does not follow the runtime layout calculation, potentially leading to out-of-bounds read. For the new TX API, responses with frame_count != 1 are rejected.

In the iwlwifi mvm driver, an incorrect indexing of the tid_data array was found — using the loop counter instead of the actual TID value. Currently it causes no harm, but a bounds check was added to prevent potential out-of-bounds access.