Vulnerability Disclosures & Security Research

CyStack researcher Trung Nguyen discovered a heap-based buffer overflow (CWE-122) in HP Linux Imaging and Printing (HPLIP), the driver and management suite that Linux distributions ship for HP printers and scanners, and reported it to HP PSRT, which fixed it under security bulletin HPSBPI04151. The flaw is reachable over the network without authentication and needs only a user action, such as letting the affected HPLIP component process attacker-supplied data. Overflowing the heap buffer corrupts adjacent memory and can be turned into code execution with the HPLIP process's privileges, giving the attacker full control of the affected workstation or print server and the print and scan data, credentials, and files it holds. HP rates the issue High (CVSS 4.0 score 8.6, with high confidentiality, integrity, and availability impact). It affects all HPLIP versions before 3.26.6; upgrading to 3.26.6 fixes it.

CyStack researcher Trung Nguyen discovered an out-of-bounds write flaw (CWE-787) in HP Linux Imaging and Printing (HPLIP), the driver and management suite that Linux distributions ship for HP printers and scanners, and reported it to HP PSRT, which fixed it under security bulletin HPSBPI04151. The flaw is reachable over the network without authentication and needs only a user action, such as letting the affected HPLIP component process attacker-supplied data. A successful write outside the intended buffer corrupts the process's memory, letting the attacker crash it or tamper with its data and potentially run code with its privileges on the workstation or print server. HP rates the issue High (CVSS 4.0 score 7.0, with high integrity impact). It affects all HPLIP versions before 3.26.6; upgrading to 3.26.6 fixes it.

CyStack researcher Duong Tran discovered an authorization flaw in MariaDB Server's CONNECT engine that lets a low-privileged database user read and write server-side files without the normally required `FILE` privilege, and proved it by accessing files outside the SQL account's authorized boundary. The CONNECT UDFs `json_file()`, `bson_file()`, and `jbin_file()` read attacker-selected paths, while `jfile_make()` and `bfile_make()` create files, but none checked either the caller's global `FILE` privilege or the administrator's `secure_file_priv` directory restriction. On a server where CONNECT and these UDFs are installed, an authenticated remote attacker able to invoke them can therefore access any path the MariaDB service account can reach, potentially exposing configuration, credentials, or application data and altering writable files; operating-system permissions still limit the impact. The flaw affects MariaDB Server 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1; upgrading to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 fixes it.

CyStack researcher Trung Nguyen discovered a flaw in how Mozilla Thunderbird handles calendar invitation attachments. On Windows, a malicious invitation can use a file URI attachment to launch a local or network-hosted executable, bypassing Thunderbird's normal protections against executable attachments. With the new invitation display enabled, the attachment can also be shown under a misleading filename, making the lure more convincing. An attacker who gets a victim to open a crafted invitation can thus run arbitrary programs on their machine. It affects Thunderbird before 153.2; upgrading to 153.2 or 154 fixes it.

CyStack researchers Trung Nguyen and Phuc Nguyen discovered a use-after-free flaw in Valkey's Lua script debugger, and proved it by reliably crashing the server with a short sequence of ordinary scripting commands. Since the Lua engine became a module in the 9.1 line, the debugger builds its command table once and caches a raw pointer to the current Lua interpreter state, and that cache is never invalidated. `SCRIPT FLUSH ASYNC` recreates the engine and frees the old interpreter, so the next `SCRIPT DEBUG` command dereferences freed heap memory. An attacker who reclaims that chunk with a counterfeit interpreter state can make the interpreter call an allocator function pointer they control, turning the crash into a path toward code execution inside the database process. A second use-after-free in the debugger's log handling is fixed in the same change. The risk is realistic because any client allowed to run scripting commands can trigger it, and many Valkey deployments run without authentication on internal networks. The flaw affects Valkey 9.1.0 and 9.1.1 (8.x and 9.0.x are not affected); upgrading to 9.1.2 fixes it, and restricting `SCRIPT DEBUG` via ACLs is a temporary mitigation.

CyStack researcher Trung Nguyen found a flaw in Grafana Alloy that lets a low-privileged Kubernetes user steal the monitoring agent's credentials. Alloy's `prometheus.operator.servicemonitors` component turns user-supplied `ServiceMonitor` resources into scrape jobs, and it carried over the `bearerTokenFile` setting unchanged — that setting tells Alloy to read a file from its own filesystem and send the contents as the bearer token on every scrape request. An attacker who can create or edit a ServiceMonitor in a watched namespace simply points `bearerTokenFile` at Alloy's projected Kubernetes service account token and sets the scrape target to a server they control; Alloy then delivers its own credentials to the attacker, who inherits Alloy's cluster-wide monitoring permissions — and can read any other file Alloy's process can reach the same way. It affects versions 1.0.0 through 1.18.1; version 1.19.0 fixes it by refusing local-file references (`bearerTokenFile` and the `tlsConfig` file fields) in user-supplied ServiceMonitors unless an operator explicitly opts back in.

CyStack researcher Khanh Vu discovered an authentication bypass in the Automation Broker of Splunk SOAR. The broker trusts a client-supplied source IP header to decide whether a request is authorized, so an unauthenticated attacker can spoof the originating IP and forge requests to a notification endpoint that should be restricted. This lets the attacker reach privileged functionality and achieve remote code execution on the Splunk SOAR host, fully compromising its confidentiality, integrity, and availability. It affects Splunk SOAR before 8.6.0; upgrading to 8.6.0 fixes it.

CyStack researcher Duong Tran discovered an authorization flaw in Wazuh Manager that exposes the cluster's shared secret to a low-privilege user, and proved it by retrieving `cluster.key` in clear text from the official Wazuh Manager 4.14.5 image. Wazuh's `mask_sensitive_config()` hides configuration secrets only when `_has_update_permissions()` says the caller cannot edit the configuration, but that check treated any `manager:update_config` or `cluster:update_config` rule as permission—even one whose effect is `deny`. An authenticated monitoring account with configuration-read access and an explicit update deny can therefore make one raw-configuration request and receive the real key instead of `*****`; adding the restrictive rule is what triggers the leak. Because the key authenticates inter-node cluster traffic, its disclosure could enable attempts to join or impersonate a node when the cluster port is reachable, although Wazuh describes that follow-on attack as plausible rather than verified. The flaw affects Wazuh Manager 4.14.0–4.14.6 and 5.0.0-beta1/beta2; upgrading to 4.14.7 or 5.0.0-beta3 and later fixes it.

CyStack researcher Trung Nguyen discovered an arbitrary file read in HashiCorp's Vault Secrets Operator that lets a low-privileged Kubernetes tenant steal the operator's own credentials. The operator allowed a VaultAuth resource to name a file on disk holding the AppRole secret ID (`spec.appRole.secretIDPath`); it rejected path-traversal sequences and checked that the target was a regular file under a size limit, but never restricted which files could be named. Any tenant able to create VaultAuth, VaultConnection and VaultStaticSecret resources could therefore point that field at any file the operator pod can read — its Kubernetes service account token, mounted TLS keys, other tenants' Vault credentials — and, by pairing it with a VaultConnection aimed at a server they control, have the operator send the contents straight to the attacker. Because the operator runs cluster-wide with far more privilege than the tenant, a limited namespace foothold turns into privilege escalation across the whole cluster, which is why it scores 9.6/10. It affects versions 1.3.0 through 1.4.1; version 1.5.0 removes the field entirely and existing configurations must migrate to `spec.appRole.secretRef`.

CyStack researcher Trung Nguyen discovered an incorrect-default-permissions vulnerability in Microsoft PowerShell that lets a local, low-privileged attacker elevate to SYSTEM privileges. Microsoft identifies the root cause as permissions that are too broad by default: an authorized attacker can submit controlled input to the vulnerable operation and, after required interaction by another user, cross the local privilege boundary and gain full control of the machine. The attack has low complexity and requires a local foothold but not administrator rights; Microsoft says exploitation is less likely and has not observed it in the wild. The flaw affects PowerShell 7.4.0 up to but excluding 7.4.19, 7.5.0 up to but excluding 7.5.10, and 7.6.0 up to but excluding 7.6.5; upgrading to 7.4.19, 7.5.10, or 7.6.5 fixes it.

CyStack researcher Huy Nguyen discovered a TLS verification bypass in Node.js's HTTPS Agent. The agent pools and reuses TLS sessions, but the reuse logic did not account for connections made under different identity policies, so a session established for one host could be reused for another without re-checking the hostname. That lets a man-in-the-middle reuse a valid session to serve a different host while skipping the hostname verification that would normally reject it. It is an incomplete fix for CVE-2026-48934 and affects the 22.x, 24.x, and 26.x lines; upgrading to v22.23.2, v24.18.1, or v26.5.1 fixes it.

CyStack researcher Trung Nguyen discovered a local privilege escalation flaw in the Accounts component of Apple macOS. A parsing issue in how directory paths are handled let an app supply a crafted path that escaped the intended directory, so an unprivileged application could abuse it to gain root privileges on the machine. Apple addressed it with improved path validation. It affects macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6; updating to those releases fixes it.

CyStack researcher Trung Nguyen discovered a kernel memory-corruption flaw in the HFS filesystem component of Apple macOS. A memory-handling error lets a remote user cause unexpected system termination (a kernel panic) or corrupt kernel memory, crashing the machine and, in the worst case, undermining the integrity of the kernel itself. Apple addressed it with improved memory handling. It affects macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6; updating to those releases fixes it.

CyStack researcher Trung Nguyen discovered an out-of-bounds memory corruption flaw in the Linux kernel's HID multitouch driver and proved it by making a malicious multitouch device reliably panic the host kernel. The driver kept every contact slot's active state in the bits of a single `unsigned long`, but indexed those bits using `ContactCountMaximum`, a value supplied by the device that can reach 255 rather than the 32 or 64 bits the word can hold. A device advertising about 250 contacts can therefore make the sticky-fingers release timer clear bits through neighboring fields in `struct mt_device`, zero a list pointer, and trigger a NULL dereference in softirq context. An untrusted USB or Bluetooth peripheral needs no account or privilege on the target, and an already connected or automatically reconnecting Bluetooth device can trigger the flaw without further user interaction. The demonstrated impact is a repeatable denial of service; because the attacker-directed bit operations also reach adjacent kernel pointers, the kernel.org CNA assesses potential kernel memory disclosure, further memory corruption, and code execution. The faulty change first appears in stable branch releases 5.10.246, 5.15.196, 6.1.158, 6.6.114, 6.12.55, and 6.17.5, and remained in newer mainline releases until 7.2-rc3. Fixed releases are 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.39, 7.1.4, and 7.2-rc3; users should install the fixed release for their branch or a later maintained kernel.

CyStack researcher Trung Nguyen discovered a denial-of-service vulnerability in RabbitMQ's Shovel plugin and proved it by wedging a broker within about a minute. When a management user with the 'policymaker' tag sets Shovel runtime parameters, several of the supplied values are turned into Erlang atoms before they are bounded or checked against a fixed allowlist. Erlang atoms are global to the VM and are never garbage-collected, so an attacker who can create Shovel parameters can permanently consume entries in the node-wide atom table until the node crashes — in the tested lab, in roughly 64 seconds. The dangerous twist is persistence: the malicious parameters are stored durably, so every later broker restart re-parses them and recreates the atom pressure with no attacker even connected, and can block normal restart recovery until the stored parameters are removed offline. Because a single vhost-scoped privilege exhausts a global VM resource, one tenant can take down the whole node, including other vhosts. It affects RabbitMQ 4.2.0–4.2.8 and 4.3.0–4.3.2; upgrading to 4.2.9 or 4.3.3 fixes it.

CyStack researcher Trung Nguyen discovered a denial-of-service vulnerability in RabbitMQ, one of the most widely deployed open-source message brokers, and proved it by killing a memory-limited broker with a single HTTP request. When the stream management plugin handles a request to create a super-stream, it parses the attacker-controlled 'binding-keys' field and builds the entire stream-name list in memory before it checks whether the user is allowed to configure those streams. As a result a low-privileged management user — one with access to a vhost but no configure, write, or read permission — can force a huge transient allocation ahead of the permission check: in a 768 MB container a single PUT with about 4.5 MB of JSON body was enough to OOM-kill the node (Docker exit 137). The impact is worst in Kubernetes, Docker, or systemd deployments that run RabbitMQ under a hard memory cap, where one request takes the whole node offline. It affects RabbitMQ 4.1.0–4.1.10, 4.2.0–4.2.8, and 4.3.0–4.3.2; upgrading to 4.1.11, 4.2.9, or 4.3.3 fixes it.

CyStack researcher Duong Tran discovered an authorization-bypass vulnerability in RabbitMQ's Federation plugin that breaks the broker's core tenancy boundary, and proved it by draining another tenant's messages. Vhost isolation is what keeps tenants apart in RabbitMQ, and a 'policymaker' user is supposed to be confined to the vhosts it can log into. But when a federation-upstream is defined with an empty-host ("direct") URI, the validator never checks the creating user against the vhost embedded in that URI — the exact check RabbitMQ's own Shovel plugin performs on the same primitive. As a result a low-trust 'policymaker' on one vhost can declare an upstream, queue, and policy that pull messages out of a completely different vhost it has no permission on; the federation link connects internally as a privileged 'none' user that approves every check. With the default ack mode the victim's messages are consumed and deleted, not merely copied, so it is both a confidentiality breach and data loss across the tenancy boundary. It affects RabbitMQ 3.13.0–3.13.17, 4.0.0–4.0.23, 4.1.0–4.1.13, 4.2.0–4.2.8, and 4.3.0–4.3.2; upgrading to 3.13.18, 4.0.24, 4.1.14, 4.2.9, or 4.3.3 fixes it.

CyStack researcher Trung Nguyen discovered a denial-of-service vulnerability in Unbound, one of the most widely deployed open-source DNS resolvers, and proved it by crashing the resolver with a single malicious DNSCrypt query sent over TCP. The routine that encrypts DNSCrypt replies in place fails to bound the reply length against the destination buffer: the size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65,504 bytes is shifted forward by 48 bytes and written past the end of the heap allocation. One bad query is enough to crash the server and knock DNS resolution offline for everyone behind it. The flaw is reachable by any remote client when Unbound is compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause is enabled on listening interfaces — a common setup for privacy-focused public resolvers. It affects Unbound 1.9.0 through 1.25.1; upgrading to 1.25.2 fixes it.

CyStack researcher Thanh Nguyen discovered a denial-of-service vulnerability in the JSON component of Oracle MySQL Server. An attacker with only a low-privileged database account can trigger it over the network and make the server hang or crash repeatedly, taking the database offline. Because JSON columns and functions are used heavily by modern applications, the affected code path is reachable by ordinary application queries rather than administrative ones. It affects MySQL Server 8.4.0–8.4.10 and 9.7.0–9.7.1 and MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1; Oracle's July 2026 Critical Patch Update fixes it.

CyStack researcher Thanh Nguyen discovered a denial-of-service vulnerability in the GIS (geospatial) component of Oracle MySQL Server. Any attacker holding even a low-privileged database account can reach the flaw over the network and make the server hang or crash repeatedly, knocking the database offline for every application that relies on it. The low bar matters: ordinary application accounts are usually enough, so a single compromised or hostile user can disrupt the whole service. It affects MySQL Server and MySQL Cluster 9.7.0–9.7.1; Oracle's July 2026 Critical Patch Update fixes it.