CVE-2026-92087
HighCVSS 8.1Summary
@fastify/auth versions 5.0.0 through 5.1.0 have a vulnerability related to strategy evaluation order when using "or" relation with "all" option and a nested AND group. Some requests may be authorized when they should be rejected (e.g., an attacker with a valid API key but not an administrator).
Risk Assessment
Risk of unauthorized access to protected resources, potentially leading to security and integrity breaches.
Recommendation
Upgrade @fastify/auth to 5.1.1 or later. If not possible, omit the "all" option, order each AND group so the stricter check is last, or use explicit top-level "and" composition.
Related vulnerabilities
- CVE-2026-116508Critical
TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.
- CVE-2026-116506Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.
- CVE-2026-116505Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-116504Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-110720Critical
consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules. This may allow an attacker to obtain elevated Consul privileges.
- CVE-2026-10757Critical
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with service access privileges to issue database-specific functions that should not be allowed.
- CVE-2026-102649Critical
A vulnerability in the Burrito Kubernetes operator (Terraform Automation Collaboration Software) prior to 0.13.0 allows the POST /api/webhook endpoint to accept unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value. Anyone who can reach the burrito-server endpoint and knows a tracked repository's URL can forge events to create or delete TerraformPullRequest custom resources with attacker-chosen Branch, Base, and ID fields. For GitHub pull_request events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch, potentially causing an unauthorized terraform plan using the operator's stored git and cloud credentials.
- CVE-2026-115905Critical
Through 9.0.4, the Rust zip library's ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata. A crafted archive can appear benign to a component inspecting the central directory but cause a streaming extractor to write a different attacker-selected path and content.
- CVE-2026-112346Critical
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default.
- CVE-2026-93328Critical
Path Traversal and Missing Authorization in the cloud-storage source of Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
Original NVD description (English source)
@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as an AND group, the group is evaluated in an order-dependent way: an earlier failing check is silently dropped and the group's result becomes the outcome of its last check. As a result, a request that satisfies only the last member of an AND group, for example an attacker who holds a valid API key but is not an administrator, is authorized instead of rejected, and a related order-dependent bypass affects the mirror configuration where the top-level relation is "and" and a nested group uses "or". The issue is fixed in @fastify/auth 5.1.1, and users should upgrade to 5.1.1 or later. As a workaround, omit the run "all" option where it is not required, order each AND group so its stricter check is evaluated last, or replace nested AND groups with an explicit top-level "and" composition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS