Loading story…
Two critical ArangoDB vulnerabilities, GHSA-rrgq-978q-36mq and GHSA-rvhw-4hpw-9vrx, affect releases through 3.12.10.1. The first abuses inconsistent raw-versus-decoded URL handling to reach protected API endpoints without credentials when the default system-only authentication configuration is used. The second enables a database user with write permissions to manipulate the isSystem field and schedule JavaScript tasks that execute in a privileged internal context.
Attackers can chain the flaws to gain administrative database access and execute code on the underlying host, potentially as root. Risk is especially acute for the official container image, where arangod runs as root. ArangoDB fixed the issues in version 3.12.11; organizations should upgrade promptly, restrict database exposure, rotate potentially exposed credentials and secrets, and investigate anomalous API requests and JavaScript task creation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Advisories for GHSA-rrgq-978q-36mq and GHSA-rvhw-4hpw-9vrx were published, documenting potential unauthenticated access to protected APIs and privileged task execution. CVE identifiers were still pending at the time of disclosure.
ArangoDB released version 3.12.11 to fix both critical vulnerabilities. The fixes addressed the URL-decoding authentication bypass and insufficient authorization of privileged background tasks.
Remedio reported two HTTP-interface vulnerabilities in ArangoDB: an authentication bypass (GHSA-rrgq-978q-36mq) and privileged JavaScript task execution issue (GHSA-rvhw-4hpw-9vrx). The flaws affect releases through version 3.12.10.1 and can be chained for administrative access and privileged host actions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceremedio.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security advisories warned of two severe database software vulnerabilities with immediate internet-facing risk. In MongoDB, an unauthenticated network attacker can trigger an information disclosure flaw—described in some reporting as **MongoBleed**—to make a vulnerable server return sensitive data such as credentials, secrets, and personal information. The issue affects MongoDB releases dating back to about 2017 and stems from insufficient validation in the `zlib` implementation, which can leak uninitialized heap memory allocated to MongoDB. Working exploitation methods are known, and defenders were told to watch for large volumes of malformed or compressed requests, decompression or memory-handling errors, and repeated unauthenticated connections. Patches are available in versions `8.2.3`, `8.0.17`, `7.0.28`, `6.0.27`, `5.0.32`, and `4.4.30`, while end-of-life branches remain unpatched. A separate advisory disclosed a **critical Redis vulnerability** affecting `8.2.1` and earlier when Lua scripting is enabled, which is the default configuration. The flaw is a use-after-free condition that can be triggered by a specially crafted Lua script and may allow **remote arbitrary code execution**, giving an attacker full control of the host running Redis. Officials urged immediate upgrades because the vulnerability is publicly known and exploitation could begin within hours, and they advised organizations to inspect any previously exposed Redis environments for signs of compromise. Fixed versions were listed as `6.2.20`, `7.2.11`, `7.4.6`, `8.0.4`, and `8.2.2`, alongside renewed guidance that Redis instances should not be exposed directly to the public internet.
Jun 29, 2026
MongoDB disclosed multiple vulnerabilities in **MongoDB Server** and the **MongoDB Java Driver**, including one critical issue and at least 16 high-severity flaws that can lead to remote code execution, information disclosure, authentication bypass, data manipulation, and denial of service. National cyber agencies in Italy, Canada, and Guyana published advisories urging organizations to review MongoDB’s security bulletins and update affected deployments. A key server-side issue, **`CVE-2026-18691`** / **`SERVER-130264`**, affects intra-cluster SASL egress connection setup and can allow an attacker with adjacent network access to downgrade authentication to **`PLAIN`**, exposing a cleartext keyfile and potentially enabling authentication as MongoDB’s internal superuser. Advisories say the server flaw affects versions before **`7.0.40`**, **`8.0.29`**, **`8.2.13`**, **`8.3.8`**, and **`9.0.0-rc2`**, while the Java Driver issue **`JAVA-6266`** affects versions **`4.11.0`** through **`5.9.1`** and can expose a proxy password through `ProxySettings.toString`; administrators are advised to upgrade to patched releases immediately.
Aug 14, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026