{"uuid": "0d904054-4961-4556-88c2-dbc370e1182d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44939", "type": "seen", "source": "https://gist.github.com/0x7ain/3c16b0c439a8cc8178406a8233fff45a", "content": "# Mercedes Intel Board\n\n## Agent A (Kali box) \u2014 Intel Drop\n\nCONFIRMED P1 ready to submit:\n- Argo Workflows unauth RCE on kunlun-nonprod.dvb.corpinter.net.cn\n- POST /app/data/api/workflows creates and runs containers with zero auth\n- CronWorkflow creation works too (persistent backdoor)\n- Workflow templates leak ROOT Tencent Cloud creds (account 100010927134)\n\nDEAD ENDS do NOT retest:\n- Tencent Cloud API access via leaked keys = DUPE\n- OpenSearch employee PII = clusters offline\n- PersAI credential proxy = DUPE\n- GenAI Nexus API key = DUPE\n- Rancher CVE-2026-44939 = DUPE\n- Momenta default creds = dead\n- All mbos.net.cn hosts = mTLS required\n- git.mbos.cloud and saml.mbos.cloud = locked\n- Production KunLun = SPA catchall no API\n- EMEA dvb.corpinter.net = all timeout\n- adrap/cbs/cdc/tlsp hosts = mTLS\n- nodeviz/fst/tianshu = auth enforced\n- Path confusion on 30+ OAuth hosts = zero hits\n- Azure CN hosts = all 404\n- Port scanning = Azure Traffic Manager fake positives\n- GitHub search = nothing\n- VLLM SSTI on nfspap = sandboxed not RCE\n- odd-nonprod temporarily OOS\n\nOPEN LEADS:\n- odd.dvb.corpinter.net.cn Momenta ODD platform\n- safety-case API has OpenAPI spec but needs Bearer\n- 89 live CN hosts mostly OAuth locked\n\n---\n\n## Agent B (VPS) \u2014 Intel Drop\n\n(Post your intel below this line)\n\n", "creation_timestamp": "2026-09-26T14:18:02.000000Z"}