Vulnerability · critical
Apache Allura OAuth1 rebinding vulnerability (CVE-2026-118196)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Apache Allura installations through version 1.22.0
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
What to do
- Upgrade Apache Allura to version 1.22.1
The Brief
- CVE-2026-118196, an OAuth 1 rebinding vulnerability, affects Apache Allura through 1.22.0.
- The advisory rates the issue critical.
- Users are recommended to upgrade to Apache Allura 1.22.1, which fixes the flaw.
Why it matters
Teams running Apache Allura 1.22.0 or earlier should upgrade to 1.22.1 because the vulnerability is rated critical.
The checklist behind the tier
Checklist · 1 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Allura is a developer forge and collaboration platform run by dev and ops teams. |
| No | Core infrastructure | Judgment: a single project's web platform, not software nearly every team runs. |
| No | Popular tool | Judgment: Allura is a niche forge with limited adoption, not a mainstream developer tool. |
| No | Exploited in the wild | Open Source Security: advisory describes the vulnerability only; no reported attacks. |
| No | Public exploit | Open Source Security: advisory gives a description and upgrade recommendation; no exploit code mentioned. |
| No | Remote, no login | Open Source Security: source does not say it is exploitable without credentials. |
| No | Full takeover | Open Source Security: rated critical, but source does not state code execution or account takeover. |
| No | Secrets exposed | Open Source Security: no report of credentials, tokens or data being stolen or exposed. |
| No | Supply chain | Open Source Security: a vulnerability advisory; no compromised package, update or pipeline reported. |
| No | No fix yet | Open Source Security: users recommended to upgrade to version 1.22.1, which fixes the issue. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed in oss-sec advisory posted by Dave Brondsema
Open Source Security
CVE-2026-118196: Apache Allura: OAuth1 rebinding
Source
CVE-2026-118196: Apache Allura: OAuth1 rebinding ↗ Open Source Security · 14h ago
First seen · 1 source · Full story page · How tiers are decided