NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
RSS

2026-10-13 Daily Security Intelligence

CSSA 2 · CVE 2 · Poison 2

10.0 Critical · Permission parsing logic flaw in the RocketMQ ACL migration com…

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 9.8 Critical

JEXL expression injection in OpenTSDB leads to unauthenticated remote code execution

An attacker exploits the lack of sandbox isolation on the /api/query/exp endpoint by constructing a malicious JEXL expression containing Java reflection calls. This bypasses a validation mechanism that only checks syntactic validity and triggers the Runtime.exec method to execute arbitrary operating system commands. Because authentication is disabled in the default configuration, the vulnerability is reachable over the network without privileges, leading to full server compromise, data leakage, lateral movement, and service disruption.

Component
OpenTSDB is a distributed time-series monitoring system built on HBase, and its core architecture relies on efficient time-series data storage and retrieval. The system provides data collection, query, and visualization interfaces through a RESTful API to support performance monitoring and analysis of large-scale infrastructure, and it integrates a JEXL engine internally to support complex dynamic data aggregation and logical operations for multi-dimensional real-time monitoring.
Type
Code Injection (CWE-94)
Repo
github.com/OpenTSDB/opentsdb · Stars 5064
Remediation
  • Enable a strict expression sandbox mode and restrict the JEXL engine's access to Java classes; enforce mandatory authentication to prevent unauthorized access to sensitive APIs; apply deep content filtering to user input and reject expressions containing dangerous class names or method calls; upgrade the component to a fixed version promptly and deploy the service following the principle of least privilege.
CSSA Exclusive Early Warning 10.0 Critical

Permission parsing logic flaw in the RocketMQ ACL migration component leads to unauthorized access risk

The vulnerability exists in the migration from RocketMQ ACL 1.0 to 2.0, where the AuthMigrator component contains a serious logic error when parsing legacy configurations. When it encounters a non-standard or unrecognized permission string (such as ANY or a typo), the code converts it by default into allowing all actions (Action.ALL) with an allow decision (Decision.ALLOW) instead of denying access as expected. An attacker can exploit this flaw without complex interaction by crafting a specific legacy configuration file or leveraging existing malformed configurations, gaining full access to resources that should have been denied and enabling unauthorized reading or tampering of sensitive data.

Component
Apache RocketMQ is a distributed messaging middleware whose core architecture includes Broker, NameServer, and client components, designed to provide high-throughput, low-latency message publishing and subscription. The ACL module provides fine-grained access control to ensure that different users' read and write permissions on Topic and Group resources comply with security policies, supporting stable operation and data isolation for enterprise message queues.
Type
Incorrect Authorization (CWE-863)
Repo
github.com/apache/rocketmq · Stars 22636
Remediation
  • Fix the permission parsing logic so that allow decisions are granted only for explicitly defined valid permission values, and strictly map all unknown or illegal input to a deny state, following the principle of least privilege and preventing privilege escalation.

CVE Intelligence 2

CVE-2026-108892 CVSS 10.0 Critical 2026-10-12

Stack overflow in the Linksys E1700 Mac Filter component leads to remote code execution

In Linksys E1700 version 1.0.0.4.003, the ssid1MACFilter function in the /goform/ssid1MACFilter file of the Mac Filter component contains a security flaw. Improper handling of the newap_text_%d parameter causes a stack-based buffer overflow (CWE-119). An attacker can launch the attack remotely and use the flaw to overwrite stack memory, potentially achieving remote code execution. The exploit has been publicly disclosed, and the vendor was contacted early about the disclosure but did not respond; no official patch is currently available. All devices running Linksys E1700 1.0.0.4.003 firmware are affected. An attacker can trigger the vulnerability remotely over the network without user interaction, so the risk is extremely high.

Component
Linksys E1700 is a home wireless router that provides Wi-Fi connectivity and network management features, and its Mac Filter component controls which devices are allowed to join the network.
Risks
  • Complete system control: An attacker can execute arbitrary code on the router and gain full control of the device, including modifying configuration, stealing data, or enlisting it in a botnet
  • Remote attack without interaction: An attacker only needs to send a crafted network request to the target device to trigger the vulnerability, without any user click or interaction
  • Service disruption and data leakage: The stack overflow may crash the device (denial of service) or allow an attacker to read sensitive memory data
Source
NVD · CVE-2026-108892
Remediation
  • Immediately isolate affected Linksys E1700 devices and avoid exposing them directly to the public internet
  • Deploy an intrusion detection system (IDS) at the network boundary to monitor anomalous requests targeting /goform/ssid1MACFilter
CVE-2026-108907 CVSS 10.0 Critical 2026-10-13

Authentication bypass in Netcore NR268 CGI Execution leads to remote code execution

In Netcore NR268 version 1.7.121109, a logic flaw in the user_ok function of the CGI Execution component results in an improper authentication (CWE-287) vulnerability. An attacker can send requests remotely to bypass the authentication mechanism and directly gain control of the system. The exploitation method has been publicly disclosed, and the vendor did not respond early in the disclosure, so the risk is extremely high. All devices running Netcore NR268 1.7.121109 are affected. An attacker can launch the attack remotely without user interaction, potentially causing data leakage, integrity damage, and service unavailability.

Component
Netcore NR268 is a network device whose CGI Execution component handles request interactions for the Web management interface.
Risks
  • Complete system control: An attacker can bypass authentication and execute arbitrary code on the victim system and, depending on privileges, install programs, view/change/delete data, or create new fully privileged accounts
  • No user interaction: The attack can be launched remotely without user interaction; the attacker only needs to craft a specific request to trigger the vulnerability
  • High impact: With a CVSS score of 10.0, confidentiality, integrity, and availability are all severely affected
Source
NVD · CVE-2026-108907
Remediation
  • Immediately isolate affected Netcore NR268 devices and avoid exposing them to the public internet
  • Monitor CGI interface logs for anomalous access to identify potential unauthorized access attempts

Package Poisoning 2

Package Poisoning npm 2026-10-13

@xrelly-stack/bails@>= 0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
b76e35bf7f3bac446b7a0fc87b073fb8
Package Poisoning npm 2026-10-13

node-telegram-sockets@>= 0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
022fa9a712eb8aefdfe75379c9b9c880
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →