Skip to content

Commit 87f8dbc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-38c7-23hj-2wgq GHSA-465p-v42x-3fmj GHSA-gj6x-q8rh-wj6x
1 parent 48384e2 commit 87f8dbc

3 files changed

Lines changed: 226 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-38c7-23hj-2wgq/GHSA-38c7-23hj-2wgq.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-38c7-23hj-2wgq",
4+
"modified": "2026-02-26T22:47:06Z",
5+
"published": "2026-02-26T22:47:06Z",
6+
"aliases": [],
7+
"summary": "n8n has Webhook Forgery on Zendesk Trigger Node",
8+
"details": "## Impact\nAn attacker who knows the webhook URL of a workflow using the ZendeskTrigger node could send unsigned POST requests and trigger the workflow with arbitrary data. The node does not verify the HMAC-SHA256 signature that Zendesk attaches to every outbound webhook, allowing any party to inject crafted payloads into the connected workflow.\n\n## Patches\nThe issue has been fixed in n8n versions 2.6.2 and 1.123.18. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Restrict network access to the n8n webhook endpoint to known Zendesk IP ranges.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
13+
},
14+
{
15+
"type": "CVSS_V4",
16+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"
17+
}
18+
],
19+
"affected": [
20+
{
21+
"package": {
22+
"ecosystem": "npm",
23+
"name": "n8n"
24+
},
25+
"ranges": [
26+
{
27+
"type": "ECOSYSTEM",
28+
"events": [
29+
{
30+
"introduced": "0"
31+
},
32+
{
33+
"fixed": "1.123.18"
34+
}
35+
]
36+
}
37+
]
38+
},
39+
{
40+
"package": {
41+
"ecosystem": "npm",
42+
"name": "n8n"
43+
},
44+
"ranges": [
45+
{
46+
"type": "ECOSYSTEM",
47+
"events": [
48+
{
49+
"introduced": "2.0.0"
50+
},
51+
{
52+
"fixed": "2.6.2"
53+
}
54+
]
55+
}
56+
]
57+
}
58+
],
59+
"references": [
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/n8n-io/n8n/commit/3839e310bd4c3002c646c363d1411916fa195151"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/n8n-io/n8n/commit/c6520e4e87614fa60c9433e93019e211f19f65f9"
71+
},
72+
{
73+
"type": "PACKAGE",
74+
"url": "https://github.com/n8n-io/n8n"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-290"
80+
],
81+
"severity": "MODERATE",
82+
"github_reviewed": true,
83+
"github_reviewed_at": "2026-02-26T22:47:06Z",
84+
"nvd_published_at": null
85+
}
86+
}

‎advisories/github-reviewed/2026/02/GHSA-465p-v42x-3fmj/GHSA-465p-v42x-3fmj.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-465p-v42x-3fmj",
4+
"modified": "2026-02-26T22:49:14Z",
5+
"published": "2026-02-26T22:49:14Z",
6+
"aliases": [
7+
"CVE-2026-22728"
8+
],
9+
"summary": "Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations",
10+
"details": "This report shows a scope-widening issue in the rotate (re-encrypt) flow: the output scope can be derived from untrusted `spec.template.metadata.annotations` on the input sealed secret.\n\nIf a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can set `sealedsecrets.bitnami.com/cluster-wide=true` in the template metadata and receive a rotated sealed secret that is cluster-wide, enabling retargeting (`metadata.name`/`metadata.namespace`) and unsealing to recover the victim plaintext.\n\n## Relevant Links (Pinned)\n\n- Rotate handler uses `NewSealedSecret(..., secret)` after unsealing: https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/controller/controller.go#L560-L606\n- Scope derivation reads secret annotations (`SecretScope`): https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go#L112-L122\n\n## Root Cause\n\nThe rotate flow unseals the input sealed secret to a `Secret`, then reseals using `NewSealedSecret(..., secret)`.\n\nBecause `SecretScope(secret)` is computed from secret annotations, and unsealing applies `spec.template` metadata onto the unsealed secret, an attacker can influence the scope of the rotated output by mutating template annotations on the rotate input.\n\n## Attack Path\n\n1. Attacker obtains a victim `SealedSecret` object (for example via read access to resources or logs) and can submit it to the controller rotate endpoint.\n2. Attacker sets `spec.template.metadata.annotations.sealedsecrets.bitnami.com/cluster-wide=true` (and optionally retargets name/namespace fields).\n3. Rotate returns a resealed, cluster-wide sealed secret that is no longer bound to the victim name/namespace.\n4. Attacker unseals the rotated output in their chosen namespace/name to recover the victim plaintext.\n\n## Proof of Concept\n\nSetup + run:\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake test\n```\n\nCanonical output (excerpt):\n\n```\n[CALLSITE_HIT]: pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go:112 SecretScope\n[PROOF_MARKER]: scope_widened=true rotated_scope=cluster-wide\n```\n\nControl output (excerpt):\n\n```\n[NC_MARKER]: scope_widened=false strict_scope_preserved=true\n```\n\n## Fix Accepted When\n\nRotate preserves the original sealing scope and does not allow scope widening based on untrusted template metadata; strict or namespace-wide inputs cannot produce cluster-wide outputs.\n\n[poc.zip](https://github.com/user-attachments/files/25080027/poc.zip)\n[PR_DESCRIPTION.md](https://github.com/user-attachments/files/25080028/PR_DESCRIPTION.md)\n[attack_scenario.md](https://github.com/user-attachments/files/25080029/attack_scenario.md)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/bitnami-labs/sealed-secrets"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.36.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/bitnami-labs/sealed-secrets/security/advisories/GHSA-465p-v42x-3fmj"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22728"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/bitnami-labs/sealed-secrets/commit/d57ee4a8357d250e602b995399b525496ab688c1"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/bitnami-labs/sealed-secrets"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/bitnami-labs/sealed-secrets/releases/tag/v0.36.0"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-284"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-02-26T22:49:14Z",
67+
"nvd_published_at": "2026-02-26T02:16:20Z"
68+
}
69+
}

‎advisories/github-reviewed/2026/02/GHSA-gj6x-q8rh-wj6x/GHSA-gj6x-q8rh-wj6x.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gj6x-q8rh-wj6x",
4+
"modified": "2026-02-26T22:48:00Z",
5+
"published": "2026-02-26T22:48:00Z",
6+
"aliases": [],
7+
"summary": "Curio exposes database credentials to users with network access through verbose HTTP error responses",
8+
"details": "## Summary\n\nMultiple HTTP handlers in Curio passed raw database error messages to HTTP clients via `http.Error()`. When the PostgreSQL/YugabyteDB driver (pgx) returned errors, these could contain the database connection string — including hostname, port, username, and password. Additionally, the internal connection string was constructed with the plaintext password embedded in the URL, which was also included in startup error messages and could surface in logs.\n\n## Details\n\nThree components were affected:\n\n1. **PDP handlers** (`pdp/handlers.go`) — 18+ HTTP error paths passed `err.Error()` directly to HTTP responses. While these endpoints require ECDSA JWT authentication, an authenticated client (e.g., a FilPay service) that triggered a database error would receive the raw pgx error in the HTTP response body. Present since PDP was introduced in v1.25.1.\n\n2. **Market mk12 deal status** (`market/mk12/mk12_utils.go`) — The `GetDealStatus` handler included `err.Error()` in error responses: `\"failed to query the db for deal status: %s\"`. Present since v1.24.3.\n\n3. **Market mk20 auth middleware** (`market/mk20/http/http.go`) — Authentication error responses included `err.Error()`, potentially leaking database error details during auth flows. Present since v1.27.2.\n\n### Root Cause\n\nThe database connection string was constructed as:\n```\npostgresql://username:password@host:port/database?...\n```\nThe plaintext password was embedded directly in the URL. When pgx returned connection or query errors, the error text could contain fragments of this connection string. HTTP handlers forwarded these errors verbatim to clients.\n\n## Impact\n\nAn attacker with network access to Curio's PDP or Market HTTP endpoints and valid authentication credentials could intentionally trigger database errors (e.g., by sending malformed requests that cause SQL failures) and extract the YugabyteDB connection credentials from the error response. With these credentials, the attacker could directly access the database, which serves as Curio's control plane.\n\nPer Curio's [security boundary documentation](https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary), these endpoints are expected to be on a trusted network. However, defense-in-depth requires that credentials are never exposed through HTTP responses regardless of network trust assumptions.\n\n## Remediation (PR #919)\n\n1. **Connection string password masking:** The password in the connection string is replaced with `********`. The real password is set separately via `cfg.ConnConfig.Password`, so it never appears in error messages or logs.\n\n2. **HTTP handler sanitization:** All affected handlers now log the detailed error server-side and return a generic error message to the HTTP client.\n\n3. **Error filter (`errFilter`):** A new function in the database layer detects and redacts any error messages containing keywords like \"password\", \"host\", \"port\", or \"://\" before they can propagate.\n\n4. **Prometheus metrics cleanup:** Database connection metrics that could expose connection details were removed from the metrics endpoint.\n\n5. **Security boundary documentation:** A new section documents what Curio expects operators to secure.\n\n## Resources\n\n- Fix: https://github.com/filecoin-project/curio/pull/919\n- Patched release: v1.27.3-rc2",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/filecoin-project/curio"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "1.24.3"
27+
},
28+
{
29+
"fixed": "1.27.3-rc2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 1.27.2"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/filecoin-project/curio/security/advisories/GHSA-gj6x-q8rh-wj6x"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/filecoin-project/curio/pull/919"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/filecoin-project/curio/commit/551da78e0123892600d8e6dfe9de7a579055d80b"
51+
},
52+
{
53+
"type": "PACKAGE",
54+
"url": "https://github.com/filecoin-project/curio"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary"
59+
}
60+
],
61+
"database_specific": {
62+
"cwe_ids": [
63+
"CWE-209",
64+
"CWE-532"
65+
],
66+
"severity": "HIGH",
67+
"github_reviewed": true,
68+
"github_reviewed_at": "2026-02-26T22:48:00Z",
69+
"nvd_published_at": null
70+
}
71+
}

0 commit comments

Comments
 (0)