CVE-2026-34076
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Funkcja clerkFrontendApiProxy w @clerk/backend jest podatna na atak typu Server-Side Request Forgery (SSRF) w wersjach @clerk/hono od 0.1.0 do przed 0.1.5, @clerk/express od 2.0.0 do przed 2.0.7, @clerk/backend od 3.0.0 do przed 3.2.3 oraz @clerk/fastify od 3.1.0 do przed 3.1.5. Atakujący bez uwierzytelnienia może skonstruować ścieżkę żądania, która spowoduje wysłanie klucza Clerk-Secret-Key aplikacji do serwera kontrolowanego przez atakującego.
Risk Assessment
Organizacja narażona jest na wyciek wrażliwych danych, co może prowadzić do nieautoryzowanego dostępu do systemów i zasobów. Potencjalne konsekwencje obejmują utratę danych oraz naruszenie prywatności użytkowników.
Recommendation
Zaleca się aktualizację do wersji @clerk/hono 0.1.5, @clerk/express 2.0.7, @clerk/backend 3.2.3 oraz @clerk/fastify 3.1.5, aby usunąć tę podatność. Należy również przeprowadzić audyt bezpieczeństwa aplikacji w celu zidentyfikowania innych potencjalnych zagrożeń.
Related vulnerabilities
- CVE-2026-13312Critical
The described vulnerability could allow an attacker to compromise a system. Technical details are not provided in the description.
- CVE-2026-115646Critical
A partial string comparison vulnerability in HiRDB. The issue affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and Version 9 (from 09-50-06 through 09-66-22), including versions with additional functions.
- CVE-2026-89126Critical
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-89119Critical
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. An unauthenticated attacker could trick a logged-on administrator into visiting a malicious link, causing unintended actions in the administrator's session and potentially leading to full compromise of the underlying operating system.
- CVE-2026-89103Critical
SAP Gateway activates the default Access Control List with high privileges, allowing categorization of an external attacker as an internal application server. An unauthenticated attacker with network access to SAP Gateway could exploit this weakness to perform unauthorized actions within the application environment.
- CVE-2026-76965Critical
SAP NetWeaver Application Server ABAP and ABAP Platform do not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke the affected functionality to execute arbitrary operating system commands on the underlying host.
- CVE-2026-76964Critical
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-125086Critical
D-Link M60 1.12.B01 contains hard-coded credentials in the /etc/emDaemon/mosquitto.conf file of the emDaemon MQTT Broker component. The vulnerability can be exploited remotely, and a public exploit may already be in use.
- CVE-2026-124600Critical
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, allowing an attacker to intercept it.
- CVE-2026-120017Critical
SAP NetWeaver AS ABAP and ABAP Platform do not sufficiently verify incoming authentication assertions under certain configurations. An unauthenticated attacker could submit crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts.
Original NVD description (English source)
Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS