Apache Cocoon diagnostic interfaces exposed without login (CVE-2026-108089)
Every Cocoon version lets an unauthenticated user trigger caches and read verbose debug and profile data.
38
Product
Apache Cocoon
- Mentions · 7d0
- Mentions · 30d4
- All mentions4
- First seenOct 20, 2026
- Last mentioned22d ago
Timeline
4 articles · newest firstApache Cocoon cache can leak one user's data to another (CVE-2026-108088)
On multi-user apps, cached values for one user can be served to others, and no fix is planned.
28
Apache Cocoon SQL processor allows SQL injection (CVE-2026-108087)
Missing input sanitation in the SQL processor or sql: and esql: logicsheets affects every version.
40
Apache Cocoon XEE flaw can enable SSRF and file disclosure
The retired project’s form processor is affected in every version, and the report names no fixed release.
42
Related CVEs
by mentions- ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon
- ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon
- Unauthenticated diagnostic info leak in Apache Cocoon (all versions)
- ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon
Appears with
- Apachevendor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.