{"vulnerability": "cve-2026-39833", "sightings": [{"uuid": "03d19c24-1a0f-4b7d-b9c1-7068761e26db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39833", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmgbzgl2hw2k", "content": "CVE-2026-39833 - Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent\nCVE ID : CVE-2026-39833\n \n Published : May 22, 2026, 4:16 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : The in-memory keyring returned by NewKeyring() silently accepted keys with the Confi...", "creation_timestamp": "2026-05-22T06:18:20.912303Z"}, {"uuid": "b8c1ad5f-62af-49e8-a80f-c5f8a7321a37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39833", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116620160885281925", "content": "Attention, elevated activities detected targeting x-crypto (CVE-2026-39833) https://vuldb.com/vuln/365128/cti", "creation_timestamp": "2026-05-22T20:40:35.850377Z"}, {"uuid": "9ce599f4-9fa4-4f51-8f2b-324c5ade810c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39833", "type": "seen", "source": "https://gist.github.com/rafapolo/1533b1e1d5d72d75a7f61672d23e52c2", "content": "# sciCORE Security Assessment (sample)\n\n**Rafael Polo** \u2014 IT Security Engineer\nSample writeup from an independent security review, condensed for portfolio use.\n\n## Scope & method\n\nReviewed public repos of `pescobar` (GitHub) and 19 active projects on `git.scicore.unibas.ch`\n(GitLab, incl. `imcf/`) with commits in the last 6 months. Source read of every repo, plus a\nlive OSV.dev CVE scan of every lockfile at exact pinned versions. All PoCs ran locally \u2014 on this\nlaptop or the public GHCR image sciCORE itself publishes. **No packet was ever sent to a live\nsciCORE controller, node, or service; production exploitation was neither attempted nor\nclaimed.**\n\n## Executive summary\n\n- **No hardcoded secrets** anywhere \u2014 working tree or git history, across every repo reviewed.\n- **Nothing found is exposed on a live production service today.** GitHub HIGHs are all in\n  CI/test Docker images; GitLab HIGHs are all in file-parsing code that trusts scientific input\n  (uploads, collaborator data, another user's job output). Latent vulnerabilities, not live\n  exposures.\n- **95 unique CVEs** confirmed against exact pinned versions across 7 repos (OSV.dev, re-verified\n  individually \u2014 the batch endpoint silently under-reported on two repos, corrected by\n  re-querying `/v1/query`).\n- **Recurring root causes:** `shell=True` + string interpolation instead of argv lists;\n  deserialization of untrusted bytes via `pickle`/`np.load`; missing length/header validation in\n  C++ structural parsers; supply-chain pins that are either floating or below the fixed CVE\n  version.\n- **Counterweight:** the authors *are* hardening in parallel \u2014 `torch.load(weights_only=True)`,\n  no `strcpy`, argv-based subprocess elsewhere, hash-pinned lockfiles, fail-closed asserts. Gaps\n  sit in old/portable code paths that haven't caught up yet, not systemic neglect. One clear\n  example: a build-time MUNGE key sits right next to a JWT key generated correctly at container\n  start in the *same file* \u2014 a hardening pass that didn't fully propagate.\n\n## Key findings\n\n| # | Sev | Repo | Issue |\n|---|-----|------|-------|\n| 1 | HIGH | imcf/omero-downloader | `shell=True` command injection via unescaped GUI fields (object ID, password, etc.) |\n| 2 | HIGH | schwede/openstructure | Heap buffer over-read/write in MAE parser (`strncpy` truncates, full length still used) |\n| 3 | HIGH | schwede/openstructure | OOB index in bundled TMalign/USalign mmCIF parser on short data rows |\n| 4 | HIGH | schwede/modelcif-converters | `pickle.loads`/`np.load` on user-uploaded archive bytes |\n| 5 | HIGH | GitHub Slurm repos | `wget --no-check-certificate`, no checksum, on Slurm tarball built as root |\n| 6 | MEDIUM | GitHub Slurm repos | MUNGE cluster-auth key baked into a **publicly pullable** image at build time |\n| 7 | MEDIUM | schwede/openstructure | `shell=True` across 9+ bioinformatics tool bindings (hhblits, clustalw, TMalign, MSMS\u2026) |\n| 8 | MEDIUM | ProMod3, QMEAN, tempconq | `pickle.load` on attacker-suppliable `.pkl` files |\n| 9 | MEDIUM | imcf/omero-downloader | Path traversal via server-controlled OMERO object names |\n| 10 | MEDIUM | schwede/modelarchive-py | Path traversal + SSRF from untrusted uploaded CIF content |\n| 11 | MEDIUM | schwede/kmatch | Server defaults to `0.0.0.0`, no auth, no rate limit |\n| 12 | MEDIUM | terraform-provider-slurm | Slurm config data source dumps plaintext secrets into TF state |\n| 13 | MEDIUM | ansible-collection-keycloak | No brute-force protection; admin console on public FQDN by default |\n| 14 | MEDIUM | ovca-research/drugsens | Config file `source()`'d as R code in the global environment |\n\nFull findings (LOW severity, \"done well\" notes, per-repo detail) trimmed here for length.\n\n## Two attack chains, proven end-to-end\n\nFormat: precondition \u2192 attacker steps \u2192 what breaks \u2192 one-line \"why this works.\" Everything\nbelow was executed; \u2713 marks a step actually reproduced in a sandbox.\n\n### Chain 1 \u2014 RCE on a researcher's machine (OMERO downloader)\n\n`gui.py` builds a shell command by string-formatting six untrusted fields (object ID,\ndestination, server, username, password) and runs it via `subprocess.Popen(command,\nshell=True)`. None of the fields are escaped. A crafted object ID (`42\"; touch /tmp/PWNED; echo\n\"`) or a password containing `` ` ``/`;`/`$(...)` breaks out of the quoting and the shell runs\nthe injected command **\u2713 reproduced**: marker file ended up owned by the payload, not the\ndownload script. Same pattern recurs at 9+ call sites in `openstructure`'s bioinformatics tool\nbindings.\n\nImpact: arbitrary code as the user running the GUI \u2014 their real session, not a container. Read\n`~/.ssh`, OMERO session cookies, pivot to whatever that laptop can reach.\n\n**Why this works:** `shell=True` + unescaped quotes means the shell reads attacker text as\ncommands \u2014 \"data\" and \"code\" become the same string.\n\n**Fix:** argv list instead of a shell string; treat every field as data.\n\n### Chain 2 \u2014 Leaked cluster key \u2192 forged root \u2192 job on a victim cluster\n\nFive GitLab repos call `pickle.load`/`np.load` directly on files from outside their own\npipeline (uploads, collaborator files, another user's job output) \u2014 a crafted pickle executes\narbitrary code the moment it's loaded (`__reduce__` \u2192 `os.system(...)`) **\u2713 reproduced**:\n`os.system` ran during `pickle.load()`, before any \"data\" came back. Contained by sciCORE's\nApptainer isolation to that user's own privileges and mounted storage \u2014 no cross-user process\naccess \u2014 but that still includes shared network scratch on a typical HPC layout.\n\nSeparately, on the GitHub side: two Slurm Dockerfiles generate the MUNGE cluster-auth key with\n`dd if=/dev/urandom` at **build time**, and the resulting image is pushed to a **public** GHCR\nrepo. Anyone can pull it anonymously and extract the identical key **\u2713 reproduced** (md5\nmatched across two independent pulls). Against a cluster booted locally from that same image:\n\n- fed the leaked key to an attacker-controlled `munged` \u2014 round-trip accepted \u2713\n- `sinfo` against the victim controller with no account, no password, no SSH \u2014 full cluster\n  state listed \u2713\n- forged a credential claiming `uid 0`; the victim's munge decoded it as `Success`, from a\n  foreign host it had never seen \u2713\n- `srun` executed on the victim node as `uid=0` \u2713\n\n**Why this works:** two `munged` daemons sharing one secret accept each other's identity claims\n\u2014 whoever holds the key can be *any* user, including root, to that cluster.\n\n**Honest boundary:** the \"victim\" in the cluster steps was a single-node cluster booted by the\nsame tester from the same public image \u2014 real Slurm/Munge/job execution, but not sciCORE's\nactual infrastructure. Two things stay unverified: whether a real sciCORE cluster reuses this\nexact key, and whether it's network-reachable from outside the campus VPN. What *is* proven\ninternet-wide with no prior access: extracting the key itself. The pickle\u2192munge-key \"combo\" some\nearly notes floated doesn't actually hold \u2014 the key is root/`munge`-owned at mode 400, out of\nreach of an ordinary containerized job \u2014 so it's named as a threat model, not a demonstrated\nchain.\n\n**Fix:** generate the MUNGE key at container start, not build time; rotate any key that has ever\nbeen in a public image; TLS-verify + checksum the Slurm tarball; pin base images.\n\n## Dependency CVE scan highlights (OSV.dev, exact pinned versions)\n\n| Repo | Package | Pinned | Fix | Real risk |\n|------|---------|--------|-----|-----------|\n| omero-downloader | Pillow | 12.2.0 | 12.3.0+ | Heap OOB read/write in decoders; `WindowsViewer` is direct OS command injection from previewing one file |\n| omero-downloader | urllib3 | 1.26.20 | 2.7.0+ | Cross-origin `Authorization`/`Cookie` forwarding on redirect \u2192 session-header theft |\n| terraform-provider-slurm | golang.org/x/crypto | v0.41.0 | 0.52.0+ | SSH agent key-constraint enforcement bypass (CVE-2026-39833 et al.) \u2014 see Chain-adjacent PoC: a key added with `ConfirmBeforeUse` signs with zero prompts |\n| terraform-provider-slurm | golang.org/x/net, grpc, x/mod, circl, goldmark, x/sys, x/text | various | various | 35 unique advisories total in the dependency graph, all transitive but linked into the built binary |\n| scicore-public-documentation | pymdown-extensions | 10.14.3 | 11.0.1+ | Path traversal in `snippets`/`b64` \u2014 crafted markdown can pull a CI secret or `.env` into a published doc page |\n| scicore-public-documentation | js-yaml, picomatch, click | various | various | Quadratic-CPU / ReDoS / glob-injection DoS on the docs build pipeline |\n| dash-app-scicore-demo | setuptools | 82.0.1 | 83.0.0+ | Transitive only; repo builds no sdist today \u2014 no current exposure |\n\nNote: two repos were initially reported \"clean\" because OSV's batch `querybatch` endpoint\nsilently returned slim records with no `affected` ranges. Re-querying `/v1/query` per-package\nsurfaced 20 additional CVEs \u2014 worth remembering when scripting a CVE sweep.\n\n## Remediation priority (top 8)\n\n1. Remove `shell=True` \u2014 omero-downloader `gui.py`, openstructure tool bindings (argv lists).\n2. Stop calling `pickle.load`/`np.load` on untrusted bytes \u2014 safe format or enforced trust\n   boundary (5 repos).\n3. Generate the MUNGE key at container start, not build time \u2014 one-line fix, already done\n   correctly for the JWT key in the same file.\n4. TLS-verify + checksum the Slurm tarball download; pin base images to digests.\n5. Add length/header validation to the MAE and TMalign/USalign parsers (heap corruption on\n   untrusted `.mae`/mmCIF input).\n6. Bump `golang.org/x/crypto`, `x/net`, `grpc` and friends; add `govulncheck` to CI.\n7. Bump Pillow and urllib3 in omero-downloader; bump pymdown-extensions in the docs site.\n8. Keycloak: enable brute-force protection; restrict the admin console to an allowlisted\n   hostname/IPs.\n\n---\n*Condensed sample \u2014 see the full assessment for per-repo detail, complete CVE tables, and the\nappendix proving public image pull without credentials.*\n", "creation_timestamp": "2026-08-30T14:02:15.598858Z"}, {"uuid": "9366807e-0dec-4a83-826a-d3f15798c5a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39833", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mqp5ww6arr2m", "content": "Yes Critical (9.1) CVE-2026-39831 Yes Yes Yes Yes Critical (9.1) CVE-2026-39832 Yes Yes Yes Yes Critical (9.1) CVE-2026-39833 Yes Yes Yes Yes Critical (9.1) CVE-2026-39834 Yes Yes Yes Yes Critical (9.1) CVE-2026-42496 Yes Yes No Yes Medium (9.1) CVE-2026-42508 Yes Yes Yes", "creation_timestamp": "2026-07-15T16:40:08.319323Z"}, {"uuid": "f3b6ff61-ac81-4dcd-a09c-2d8d12b73392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39833", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mulqwmqkqk2d", "content": "CVE-2026-39833 - golang-go.crypto\nThe golang.org/x/crypto/ssh/agent library in Go did not enforce a security setting for signing keys. This meant that keys could be used to sign without requiring\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#canonical #UbuntuPro1604LTS #CVE #infosec", "creation_timestamp": "2026-09-03T05:50:04.576570Z"}]}