Loading story…
Apache disclosed two moderate-severity vulnerabilities in Apache OpenMeetings that affect releases before 9.0.0, including a credential exposure issue tracked as CVE-2026-34020. The flaw stems from the REST login endpoint sending usernames and passwords through HTTP GET query parameters, which can leave credentials exposed in browser history, logs, referrers, and other URL-handling systems. Apache linked the issue to internal ticket OPENMEETINGS-2816 and fixed it in version 9.0.0.
Apache also disclosed CVE-2026-33005, an improper privilege-handling flaw in FileWebService that lets any authenticated user retrieve metadata for files and subfolders in arbitrary folders by ID. The exposed information includes fields such as id, type, and name, though not file contents. Both issues were credited to 4ra2n, described as a code security AI agent, and Apache advised users to upgrade to OpenMeetings 9.0.0 to remediate the vulnerabilities.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-33005 and CVE-2026-34020 affecting Apache OpenMeetings versions before 9.0.0, covering insufficient checks in FileWebService and exposure of login credentials in GET query parameters. Apache recommended upgrading to version 9.0.0, which remediates the issues.
Apache created JIRA issue OPENMEETINGS-2816 to track a vulnerability in OpenMeetings where login credentials were passed via HTTP GET query parameters.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceissues.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache OpenMeetings disclosed a critical path traversal vulnerability, **CVE-2026-49488**, that allows a user with moderator rights in any room to read arbitrary files accessible to the operating system account running the server. The flaw affects versions **5.0.0 through before 9.1.0** and can be exploited through a crafted download request, potentially exposing sensitive local files including credentials, configuration data, and other secrets stored on the host. The issue is tracked internally as **`OPENMEETINGS-2821`** and was credited to researchers **follycat** and **Y0n3er**. Apache said the vulnerability is fixed in **OpenMeetings 9.1.0**, making upgrade the primary remediation for organizations using the web conferencing and collaboration platform.
Jul 14, 2026
The Apache Software Foundation reported handling **376 new vulnerability reports** across **101** top-level projects in 2020, closing 341 cases and assigning **151 CVEs** while adopting new tooling and the CVE automation API to speed disclosure. The report highlighted several high-profile issues, including the Apache Struts flaw tracked as `CVE-2019-0230`, where forced double OGNL evaluation in tag attributes can lead to **remote code execution** in Struts `2.0.0` through `2.5.20`, alongside other notable Apache security events that drew public exploit or proof-of-concept attention. Additional disclosures tied to that period included two Apache Flink directory traversal bugs, `CVE-2020-17518` and `CVE-2020-17519`, affecting exposed REST APIs and enabling arbitrary file write or read access on vulnerable JobManager hosts; Apache said users should upgrade to **Flink 1.11.3 or 1.12.0**. Apache also published `CVE-2020-13951`, a denial-of-service issue in the public NetTest web service of Apache OpenMeetings `4.0.0` through `5.0.0`, and `CVE-2019-0235`, a **CSRF** flaw in Apache OFBiz `17.12.01`, underscoring the breadth of web, file-system, and application-layer risks disclosed across Apache projects.
Aug 15, 2026
Apache disclosed **CVE-2026-43512**, a moderate-severity authentication bypass in Tomcat's DIGEST authenticator that can let any user unknown to the configured Realm authenticate if the supplied password is `"null"`. The flaw affects multiple supported branches, including Tomcat `11.0.0-M1` through `11.0.21`, `10.1.0-M1` through `10.1.54`, and `9.0.0.M1` through `9.0.117`, with older unsupported releases potentially affected. Apache advised users to upgrade to `11.0.22+`, `10.1.55+`, or `9.0.118+`. Apache also disclosed **CVE-2026-44417**, a moderate-severity flaw in the JMS transport component of Apache CXF caused by an incomplete fix for **CVE-2025-48913**. The remaining vulnerable code path can still lead to remote code execution when untrusted users are allowed to configure JMS. Affected releases include CXF JMS transport `4.2.0` before `4.2.1`, `4.0.0` before `4.1.6`, and all `3.6.x` versions before `3.6.11`; Apache said organizations should upgrade to `4.2.1`, `4.1.6`, or `3.6.11`.
Aug 28, 2026