47
30
47
CVE-2026-34486: Apache Tomcat Auth Bypass Vulnerability
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
CVE-2026-34486 stems from an incomplete fix for CVE-2026-29146, letting network-positioned attackers bypass the EncryptInterceptor and read plaintext Tomcat cluster traffic, including session and application data between nodes. Affected versions 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21. Workarounds include network-level encryption such as IPsec or VPN tunnels and isolating cluster communications to secured network segments.
45
55
55
47
55
60
47
Red Hat Advanced Cluster Security Cloud Service scales cloud-native security across the hybrid cloud
55
5 Components of the Kubernetes Control Plane that Demand Special Attention in Your Security Strategy
30
55
35
35
60
30
60
55
55
60
42
60
55
35
60
60
30
55
42
35
30
60
42
42
CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.
CVE-2026-82441 (severity: moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Topology submissions carry dependency_jars and dependency_artifacts blobstore key lists that Nimbus never validated on the submission path, yet acted on during cleanup of finished topologies. A malicious submitter could reference arbitrary blobstore keys, causing cross-tenant blob deletion and cluster-wide denial of service.
25
CVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
Apache Artemis CVE-2026-49364 exposes cluster credentials to network-adjacent peers discovered before authentication completes.
Apache disclosed a pre-authentication credential exposure issue in Apache Artemis and Apache ActiveMQ Artemis, tracked as CVE-2026-49364. Affected components span artemis-core-client and artemis-server from version 1.0.0 (ActiveMQ Artemis) and 2.50.0 (Artemis) through 2.44.0 and 2.56.0 respectively. An unauthenticated network-adjacent attacker can leverage credentials exposed to discovered cluster peers. Apache rates the issue as important.
35
ZDI-26-528: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI advisory ZDI-26-528 discloses CVE-2026-28220, a CVSS 9.9 deserialization RCE in Wazuh's cluster DAPI protocol exploitable by network-adjacent attackers.
Wazuh contains a deserialization-of-untrusted-data flaw in its cluster DAPI protocol, tracked as CVE-2026-28220 with CVSS 9.9. Network-adjacent attackers can execute arbitrary code on affected installations, but must first obtain the ability to execute low-privileged code on a worker node. The vulnerability was disclosed through ZDI advisory ZDI-26-528.
50
ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI discloses CVE-2026-44901, a 9.9-rated deserialization RCE in Wazuh cluster DAPI requiring low-privileged code on a worker node.
ZDI-26-527 describes a deserialization of untrusted data flaw in Wazuh's cluster DAPI protocol allowing network-adjacent attackers to execute arbitrary code. Exploitation requires the attacker to first obtain low-privileged code execution on a worker node. ZDI assigned a CVSS score of 9.9, and the flaw is tracked as CVE-2026-44901.
55
55