CVE-2026-96770
CriticalCVSS 9.3Summary
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.
Risk Assessment
An unauthenticated attacker can gain access to proxy functions and Temporal credentials, potentially leading to unauthorized operations and system security compromise.
Recommendation
Update s2s-proxy to version 0.2.3 or later if available, and consider enforcing client certificate verification.
Related vulnerabilities
- CVE-2026-93352Critical
Laravel-Mediable versions 7.0.0 to 7.0.2 contain an incomplete patch for CVE-2026-49972 — the .pht extension is missing from the forbidden_extensions blocklist in config/mediable.php. Apache on Debian and Ubuntu executes .pht files as PHP, allowing an attacker to upload a malicious file and achieve remote code execution.
- CVE-2026-6928Critical
IBM Concert versions 1.0.0 through 3.0.0 references or accesses memory after it has been freed (use-after-free). An attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.
- CVE-2026-6730Critical
IBM Concert versions 1.0.0 through 3.0.0 is vulnerable to a buffer overflow caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
- CVE-2026-6721Critical
IBM Concert versions 1.0.0 through 3.0.0 allows an unauthenticated remote attacker to supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution. Successful exploitation allows remote code execution with the privileges of the affected application.
- CVE-2026-67404Critical
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 — when no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, leading the broker to accept arbitrary JWTs.
- CVE-2026-67231Critical
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 — the trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key relies solely on issuer name and serial number, which can be easily forged, allowing TLS client authentication bypass.
- CVE-2026-87900Critical
WP Toolkit for cPanel versions 6.11.2-10794 and earlier contains an argument injection vulnerability that allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
- CVE-2026-87899Critical
cPanel contains an execution with unnecessary privileges vulnerability that allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-87898Critical
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-84719Critical
A flaw in the Ansible Automation Platform automation-controller: when copying a WorkflowJobTemplate, the deep-copy permission sanitizer validates only inventory, unified_job_template, and credentials of each cloned node and fails to check instance_groups (and execution_environment and labels) preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
Original NVD description (English source)
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.