Search: “Docker”

10 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 10 Exploit / PoC 10 Research 7 Threat actor 7 Model release 6 AI safety & security 5 Malware 4 AI tools & infra 2 Tools 2 AI research 2 Industry 1 Advisory 1 Policy & legal 1

SeverityAll critical 3 high 18 medium 16 low 1 info 20

[0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)

Jitterbit Agent 12.8.1.6's Docker image exposes unauthenticated SOAP with hard-coded credentials, leading to OS command execution (CVSS 9.8).

0day Rubbish Research Team disclosed that the jitterbit/agent:12.8.1.6 Docker image ships an unauthenticated SOAP interface protected by hard-coded credentials. Attackers who recover these credentials can invoke the SOAP endpoint to execute OS commands, with the issue rated CVSS 9.8. The disclosure does not mention a CVE identifier or observed exploitation in the wild.

Full DisclosureSep 8, 17:31 UTC · 8d agoVulnerability 2 sources1

We got admin access to Baseten's production GitHub in 25 minutes

Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.

Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.

Hacker News · AISep 15, 18:11 UTC · 1d agoVulnerability HN 51↑ · 12 comments1

Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.

Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.

The Hacker NewsSep 9, 10:43 UTC · 7d agoVulnerability in the wild1

Dell Secure Connect Gateway Vulnerabilities Allow Hackers to Gain Unauthorized Access

Dell patches three critical flaws (CVSS up to 9.8) in Secure Connect Gateway 5.0 enabling admin token replay, unauthenticated RCE, and root escalation.

Dell disclosed three critical vulnerabilities in Secure Connect Gateway 5.0 appliance and application deployments. CVE-2026-80172 (CVSS 9.8) lets unauthenticated attackers replay captured requests, which lack nonce validation and time limits, to repeatedly mint administrator access and refresh tokens. CVE-2026-61410 (9.4) is a missing-authorization flaw enabling unauthenticated remote command execution, and CVE-2026-80238 (9.3) is an exposed Docker socket allowing local privilege escalation to root and container escape. Fixes ship in appliance 5.36.00.16 and application 5.36.00.00.

Cyber Security NewsSep 8, 15:22 UTC · 8d agoVulnerability CVE-2026-80172 CVE-2026-61410 CVE-2026-80238

Homebrew 7.0.0 is out, here’s what changed for security

Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.

Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.

Help Net SecuritySep 15, 00:47 UTC · 2d agoVulnerability

CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.

CVE-2026-82430 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. When launching Docker or OCI workers, the setuid-root worker-launcher transfers ownership of the entire worker directory to the untrusted topology user before reading and acting on the supervisor-written command file in that directory. An untrusted tenant can tamper with the command file to achieve local privilege escalation to root. Fixed in version 3.1.0.

oss-securitySep 13, 14:26 UTC · 3d agoVulnerability CVE-2026-82430

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.

Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.

The Hacker Newsupdated Sep 10, 12:56 UTC · 6d agofirst Sep 10, 07:12 UTC · 6d agoVulnerability in the wild 3 sources CVE-2026-59821 CVE-2026-59822 CVE-2026-42271+2 CVEs

Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access

Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.

Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.

GBHackersSep 8, 12:04 UTC · 8d agoVulnerability CVE-2026-80172 CVE-2026-61410 CVE-2026-80238

Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics

Researchers show a single ROS 2 environment variable lets attackers inject fake telemetry and hijack robots while spoofing downstream remote attestation.

A pre-built hook loaded via one modified environment variable covertly intercepts and injects both telemetry and control signals before publication in ROS 2, breaking the physical-to-digital trust boundary in multi-robot task handovers. Attackers can also distribute compromised third-party Docker containers and auxiliary tools embedding the hooks. On a physical Franka Emika arm running Secure ROS 2, the attack injects fabricated telemetry in real time with roughly 3 ms jitter and achieved an 87% success rate even against an AI-based detector. Findings were responsibly disclosed to the ROS 2 development team.

arXiv cs.CRSep 8, 05:50 UTC · 9d agoVulnerability1

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.

CERT/CC disclosed two unpatched flaws in Kaltura's mwEmbed HTML5 player library, both rooted in unsafe deserialization in mwEmbedLoader.php and exploitable without authentication. CVE-2026-19913 (reporter-scored 9.1) reflects local file contents back via the ServiceUrl parameter, exposing secrets in local.ini; CVE-2026-19912 (reporter-scored 10.0) achieves PHP code execution by writing attacker-controlled objects into web-accessible directories via the uiconf_id parameter. No patch exists and CERT/CC could not reach Kaltura; affected releases include html5lib v2.45, v2.103 and earlier, with the shared multi-tenant CDN hosts also impacted. No exploitation or KEV listing was reported as of August 25, 2026.

The Hacker NewsAug 26, 11:55 UTC · 21d agoVulnerability CVE-2026-19913 CVE-2026-199121