https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 29 Jul 2026 21:07:54 +0000 https://vulnerability.circl.lu/sighting/20ae540c-330a-46d5-b34d-8a70c046a3fc/export {"uuid": "20ae540c-330a-46d5-b34d-8a70c046a3fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqylspu6q23", "content": "CVE-2026-54650 - openhole-server vulnerable to path traversal via URL-decoded request path\nCVE ID : CVE-2026-54650\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 21\u00a0minutes ago\n \n Description : openhole exposes localhost to the internet in one command. In 0.1.1 and earlie...", "creation_timestamp": "2026-07-29T03:34:55.728872Z"} {"uuid": "20ae540c-330a-46d5-b34d-8a70c046a3fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqylspu6q23", "content": "CVE-2026-54650 - openhole-server vulnerable to path traversal via URL-decoded request path\nCVE ID : CVE-2026-54650\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 21\u00a0minutes ago\n \n Description : openhole exposes localhost to the internet in one command. In 0.1.1 and earlie...", "creation_timestamp": "2026-07-29T03:34:55.728872Z"} https://vulnerability.circl.lu/sighting/20ae540c-330a-46d5-b34d-8a70c046a3fc/export Wed, 29 Jul 2026 03:34:55 +0000 https://vulnerability.circl.lu/sighting/99f6e6ea-5b5e-4fa4-9e58-50d06e1aa28d/export {"uuid": "99f6e6ea-5b5e-4fa4-9e58-50d06e1aa28d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://gist.github.com/alon710/82214e78c8e50d09cf347aa9a1d86bfb", "content": "# CVE-2026-54650: CVE-2026-54650: Remote Path Traversal in openhole-server and openhole CLI Client\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54650\n\n## Summary\nA critical path traversal vulnerability (CWE-22) in openhole-server version 0.1.1 and earlier allows remote, unauthenticated attackers to traverse directories and access restricted files or endpoints on local backend services exposed via the tunnel proxy. The issue stems from improper handling of decoded URL paths inside the proxy handler, which are then reconstructed and executed literally by the CLI client.\n\n## TL;DR\nA path traversal flaw in the openhole proxy server decodes percent-encoded dot-dot-slash segments and forwards them to the local agent, which executes raw, unauthorized file retrieval requests against local development services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.6\n- **EPSS Score**: N/A\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- openhole-server <= 0.1.1\n- openhole CLI client <= 0.1.1\n- **openhole**: <= 0.1.1 (Fixed in: `0.1.2`)\n\n## Mitigation\n\n- Upgrade openhole binaries and server components to version 0.1.2 or above\n- Restrict access to the public proxy using firewall rules, IP whitelisting, or authentication headers\n- Avoid running local development servers under privileged administrator accounts\n\n**Remediation Steps:**\n1. Run the default installation update script: curl -fsSL https://openhole.dev/install.sh | sh\n2. Alternatively, pull from source, checkout v0.1.2, and compile using: go build -o openhole cmd/openhole/main.go\n3. Restart any active tunnels to ensure updated path routing configurations are enforced\n\n## References\n\n- [openhole GitHub Repository](https://github.com/bablilayoub/openhole)\n- [openhole Security Patch Commit](https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54650) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T03:32:05.314932Z"} {"uuid": "99f6e6ea-5b5e-4fa4-9e58-50d06e1aa28d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://gist.github.com/alon710/82214e78c8e50d09cf347aa9a1d86bfb", "content": "# CVE-2026-54650: CVE-2026-54650: Remote Path Traversal in openhole-server and openhole CLI Client\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54650\n\n## Summary\nA critical path traversal vulnerability (CWE-22) in openhole-server version 0.1.1 and earlier allows remote, unauthenticated attackers to traverse directories and access restricted files or endpoints on local backend services exposed via the tunnel proxy. The issue stems from improper handling of decoded URL paths inside the proxy handler, which are then reconstructed and executed literally by the CLI client.\n\n## TL;DR\nA path traversal flaw in the openhole proxy server decodes percent-encoded dot-dot-slash segments and forwards them to the local agent, which executes raw, unauthorized file retrieval requests against local development services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.6\n- **EPSS Score**: N/A\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- openhole-server <= 0.1.1\n- openhole CLI client <= 0.1.1\n- **openhole**: <= 0.1.1 (Fixed in: `0.1.2`)\n\n## Mitigation\n\n- Upgrade openhole binaries and server components to version 0.1.2 or above\n- Restrict access to the public proxy using firewall rules, IP whitelisting, or authentication headers\n- Avoid running local development servers under privileged administrator accounts\n\n**Remediation Steps:**\n1. Run the default installation update script: curl -fsSL https://openhole.dev/install.sh | sh\n2. Alternatively, pull from source, checkout v0.1.2, and compile using: go build -o openhole cmd/openhole/main.go\n3. Restart any active tunnels to ensure updated path routing configurations are enforced\n\n## References\n\n- [openhole GitHub Repository](https://github.com/bablilayoub/openhole)\n- [openhole Security Patch Commit](https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54650) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T03:32:05.314932Z"} https://vulnerability.circl.lu/sighting/99f6e6ea-5b5e-4fa4-9e58-50d06e1aa28d/export Wed, 29 Jul 2026 03:32:05 +0000 https://vulnerability.circl.lu/sighting/9840f032-9c37-4aaf-8d5d-57398c9d6383/export {"uuid": "9840f032-9c37-4aaf-8d5d-57398c9d6383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqvvxefvd2s", "content": "CVE-2026-54650 - openhole-server vulnerable to path traversal via URL-decoded request path\nCVE ID : CVE-2026-54650\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 23\u00a0minutes ago\n \n Description : openhole exposes localhost to the internet in one command. In 0.1.1 and earlie...", "creation_timestamp": "2026-07-29T02:46:54.711712Z"} {"uuid": "9840f032-9c37-4aaf-8d5d-57398c9d6383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqvvxefvd2s", "content": "CVE-2026-54650 - openhole-server vulnerable to path traversal via URL-decoded request path\nCVE ID : CVE-2026-54650\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 23\u00a0minutes ago\n \n Description : openhole exposes localhost to the internet in one command. In 0.1.1 and earlie...", "creation_timestamp": "2026-07-29T02:46:54.711712Z"} https://vulnerability.circl.lu/sighting/9840f032-9c37-4aaf-8d5d-57398c9d6383/export Wed, 29 Jul 2026 02:46:54 +0000 https://vulnerability.circl.lu/sighting/2a18ba22-98e5-4f21-96df-42e5b2cf1ca4/export {"uuid": "2a18ba22-98e5-4f21-96df-42e5b2cf1ca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqtdm6wwg23", "content": "\ud83d\udfe0 CVE-2026-54650 - High (8.6)\n\nopenhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54650/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T02:00:52.181439Z"} {"uuid": "2a18ba22-98e5-4f21-96df-42e5b2cf1ca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54650", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqtdm6wwg23", "content": "\ud83d\udfe0 CVE-2026-54650 - High (8.6)\n\nopenhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54650/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T02:00:52.181439Z"} https://vulnerability.circl.lu/sighting/2a18ba22-98e5-4f21-96df-42e5b2cf1ca4/export Wed, 29 Jul 2026 02:00:52 +0000