Topic
Access Control
3 stories about Access Control that passed the news check, newest first.
Security · High impact ·
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin (CVE-2026-102895)
GPUStack before v2.2.0 treats any request from a loopback source as the built-in administrator when forceauthlocalhost is False, which is the default.
GitHub Advisory Database
Security ·
CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
Apache Airflow asset API endpoints returned IDs of Dags that schedule, produce, or consume an asset without checking the caller's read permission.
Open Source Security
Security ·
CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
The asset queuedEvents DELETE API endpoint checked Dag edit permission against the dag_id query parameter.
Open Source Security