Loading story…
Cloudflare patched a vulnerability in its ACME (Automatic Certificate Management Environment) HTTP-01 validation handling that could disable some Cloudflare WAF protections for requests to /.well-known/acme-challenge/*, potentially allowing traffic to reach otherwise protected origin servers. The issue was reported by FearsOff via Cloudflare’s bug bounty program after they observed that, in certain configurations where customers explicitly blocked broad access with WAF rules, requests sent to the ACME challenge directory could bypass those rules and be forwarded to the origin.
Independent testing described by the researchers showed that normal requests were blocked by Cloudflare as expected, while requests to the ACME challenge path elicited origin-generated responses (often application/framework 404 pages), indicating the request reached the backend. Cloudflare attributed the behavior to edge-network logic intended to avoid interfering with certificate issuance flows; when a request appeared related to ACME validation, some WAF features could be disabled and the request allowed through when it should have been blocked. Cloudflare stated the vulnerability has been mitigated, no customer action is required, and it is not aware of malicious exploitation.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Cloudflare published details of the vulnerability and its remediation, explaining the root cause, patch, and that it had no evidence of malicious exploitation. The disclosure stated customers did not need to take any action.
Cloudflare released a code change on 2025-10-27 so WAF protections are only disabled when a request matches a valid ACME HTTP-01 token for the specific hostname and Cloudflare has a challenge response to serve. Cloudflare said no customer action was required.
Cloudflare confirmed the researcher report and validated the vulnerability, determining that WAF features could be disabled for ACME-related requests even when the token did not belong to the requested hostname. Multiple sources place Cloudflare’s confirmation on 2025-10-13.
FearsOff researchers identified a logic flaw in Cloudflare’s handling of ACME HTTP-01 validation requests that could let traffic to `/.well-known/acme-challenge/*` bypass WAF protections and reach customer origin servers. They reported the issue through Cloudflare’s bug bounty/HackerOne program on 2025-10-09.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcethecyberexpress.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceblog.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass flaw, tracked as **`CVE-2026-41940`**, affects **cPanel & WHM** and **WP Squared** deployments and has been publicly reported as under active exploitation. The vulnerability can let unauthenticated remote attackers bypass normal login controls in certain conditions and potentially obtain administrative access to internet-facing hosting systems that manage websites, databases, email, DNS, SSL certificates, and customer accounts. Guidance tied to the disclosure urges organizations to apply vendor-patched builds immediately and investigate for signs of compromise, as a successful breach could expose downstream environments and sensitive business data. Recommended response actions include isolating affected servers, rotating credentials, removing attacker persistence, and rebuilding compromised systems, alongside longer-term hardening such as **MFA**, network segmentation, reduced internet exposure, tighter privileged access, and continuous vulnerability monitoring.
Jun 29, 2026
CERT Polska disclosed two **missing authorization** vulnerabilities in **MWDB Core** that were fixed in version **2.19.0**. **CVE-2026-66723** affects versions **2.2.0 through before 2.19.0** and allows an unauthenticated attacker to abuse the **Remote Instances proxy API** to send arbitrary requests to a remote MWDB instance using the configured API key’s identity and permissions. The issue is limited to deployments where **Remote Instances** are enabled. CERT Polska also reported **CVE-2026-66724**, affecting versions **2.0.0 through before 2.19.0**, which lets any authenticated user bypass capability checks on deprecated config and blob upload endpoints by using an undocumented **POST** method. The flaw is limited to unauthorized addition of config and text blob objects. Both issues were classified as **CWE-862: Missing Authorization**, underscoring authorization control failures that could let attackers act beyond intended privileges.
Jul 30, 2026
AWS patched a server-side authorization bypass in **Amazon Quick** that let authenticated non-admin users access **AI Chat Agents** through direct API requests even when administrators had explicitly blocked that capability with custom permissions. Fog Security found that the restriction was enforced in the user interface but not in the backend `Chat Agent` API, creating a **CWE-862** missing authorization flaw. Researchers showed that after AI features were disabled for users, intercepted requests could still reach the agent and return responses until AWS fixed the issue, after which the same requests returned `401 Unauthorized` and `AGENT_ACCESS_DENIED`. The exposure was limited to **intra-account** access, with no reported cross-tenant impact, but it affected the only granular control customers had for restricting Quick’s AI features because standard **AWS IAM**, **SCP**, and **RCP** controls did not apply. That raised concern because Amazon Quick can connect chat agents to enterprise data sources including Slack, Microsoft Teams, Outlook, CRMs, databases, and documents. Fog Security reported the bug through HackerOne on March 4, and AWS deployed fixes across regions by March 12, but researchers said AWS silently patched the issue, rated its severity as **"none,"** and did not issue a public customer advisory; AWS later said the affected admin control was not actively used by customers during the vulnerable period.
Jun 29, 2026