Vulnerability-Lookup

CVE-2026-26187 (GCVE-0-2026-26187)

Vulnerability from cvelistv5 – Published: 2026-02-13 18:34 – Updated: 2026-02-13 19:53

Title

lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

Summary

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names. Also, the adapter verified that resolved paths stayed within the adapter's base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces. Fixed in version v1.77.0.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/treeverse/lakeFS/security/advi…	x_refsource_CONFIRM
	https://github.com/treeverse/lakeFS/commit/cbc106…	x_refsource_MISC
	https://github.com/treeverse/lakeFS/releases/tag/…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	treeverse	lakeFS	Affected: < 1.77.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26187",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-13T19:52:09.607970Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-13T19:53:32.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lakeFS",
          "vendor": "treeverse",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.77.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names. Also, the adapter verified that resolved paths stayed within the adapter\u0027s base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces. Fixed in version v1.77.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-13T18:34:10.937Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm"
        },
        {
          "name": "https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce"
        },
        {
          "name": "https://github.com/treeverse/lakeFS/releases/tag/v1.77.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/treeverse/lakeFS/releases/tag/v1.77.0"
        }
      ],
      "source": {
        "advisory": "GHSA-699m-4v95-rmpm",
        "discovery": "UNKNOWN"
      },
      "title": "lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26187",
    "datePublished": "2026-02-13T18:34:10.937Z",
    "dateReserved": "2026-02-11T19:56:24.812Z",
    "dateUpdated": "2026-02-13T19:53:32.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-26187\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-13T19:17:29.100\",\"lastModified\":\"2026-02-13T21:43:11.137\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names. Also, the adapter verified that resolved paths stayed within the adapter\u0027s base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces. Fixed in version v1.77.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/treeverse/lakeFS/releases/tag/v1.77.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-26187\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-13T19:52:09.607970Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-13T19:53:23.436Z\"}}], \"cna\": {\"title\": \"lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access\", \"source\": {\"advisory\": \"GHSA-699m-4v95-rmpm\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"treeverse\", \"product\": \"lakeFS\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.77.0\"}]}], \"references\": [{\"url\": \"https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm\", \"name\": \"https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce\", \"name\": \"https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/treeverse/lakeFS/releases/tag/v1.77.0\", \"name\": \"https://github.com/treeverse/lakeFS/releases/tag/v1.77.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names. Also, the adapter verified that resolved paths stayed within the adapter\u0027s base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces. Fixed in version v1.77.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-13T18:34:10.937Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-26187\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-13T19:53:32.197Z\", \"dateReserved\": \"2026-02-11T19:56:24.812Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-13T18:34:10.937Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-699M-4V95-RMPM

Vulnerability from github – Published: 2026-02-13 16:16 – Updated: 2026-02-13 22:11

Summary

lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

Details

Summary

Two path traversal vulnerabilities in the local block adapter allow authenticated users to read and write files outside their designated storage boundaries.

Details

The local block adapter in pkg/block/local/adapter.go had two path traversal vulnerabilities:

1. Prefix Bypass Vulnerability

The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names.

Example: If the adapter is configured with base path /data/lakefs:

Path	Expected	Actual
`/data/lakefs/valid/file.txt`	Allowed	Allowed
`/data/lakefs_evil/secret.txt`	Blocked	Vulnerable
`/data/lakefs_backup/data.db`	Blocked	Vulnerable

2. Namespace Escape via Identifier

The adapter verified that resolved paths stayed within the adapter's base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces.

Example: With base path /data/lakefs and namespace local://repo1/userdata:

Identifier	Resolved Path	Expected	Actual
`file.txt`	`/data/lakefs/repo1/userdata/file.txt`	Allowed	Allowed
`../secrets/key.txt`	`/data/lakefs/repo1/secrets/key.txt`	Blocked	Vulnerable
`../../other-repo/data.txt`	`/data/lakefs/other-repo/data.txt`	Blocked	Vulnerable

This vulnerability allows users with access to one namespace to read and write files in other namespaces within the same lakeFS deployment.

Impact

Authenticated lakeFS users can:

Read and write files in sibling directories that share the same path prefix as the storage directory (vulnerability 1)
Access files across namespaces by using path traversal in object identifiers (vulnerability 2)

This could allow attackers to:

Read sensitive data from other repositories/namespaces
Write malicious files to other namespaces
Read/write files in adjacent directories outside lakeFS storage
Potentially escalate privileges if writable directories are used by other services

This vulnerability only affects deployments using the local block adapter. Deployments using S3, GCS, Azure, or other object storage backends are not affected.

Patches

Fixed in version v1.77.0.

The fixes: 1. Append a path separator to prefix checks, ensuring paths must be within the storage directory 2. Add two-level path validation: verify both that namespace paths stay within the adapter's base path AND that resolved paths stay within their designated namespace

Workarounds

Configure the storage path with a unique name unlikely to be a prefix of other directories
Restrict filesystem permissions for the lakeFS process
Ensure no sensitive data exists in sibling directories

Credit

Discovered via CodeQL static analysis.

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.76.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/treeverse/lakefs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.77.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-13T16:16:04Z",
    "nvd_published_at": "2026-02-13T19:17:29Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nTwo path traversal vulnerabilities in the local block adapter allow authenticated users to read and write files outside their designated storage boundaries.\n\n## Details\n\nThe local block adapter in `pkg/block/local/adapter.go` had two path traversal vulnerabilities:\n\n### 1. Prefix Bypass Vulnerability\n\nThe `verifyRelPath` function used `strings.HasPrefix()` to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names.\n\n**Example:** If the adapter is configured with base path `/data/lakefs`:\n\n| Path | Expected | Actual |\n|------|----------|--------|\n| `/data/lakefs/valid/file.txt` | Allowed | Allowed |\n| `/data/lakefs_evil/secret.txt` | Blocked | **Vulnerable** |\n| `/data/lakefs_backup/data.db` | Blocked | **Vulnerable** |\n\n### 2. Namespace Escape via Identifier\n\nThe adapter verified that resolved paths stayed within the adapter\u0027s base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces.\n\n**Example:** With base path `/data/lakefs` and namespace `local://repo1/userdata`:\n\n| Identifier | Resolved Path | Expected | Actual |\n|------------|---------------|----------|--------|\n| `file.txt` | `/data/lakefs/repo1/userdata/file.txt` | Allowed | Allowed |\n| `../secrets/key.txt` | `/data/lakefs/repo1/secrets/key.txt` | Blocked | **Vulnerable** |\n| `../../other-repo/data.txt` | `/data/lakefs/other-repo/data.txt` | Blocked | **Vulnerable** |\n\nThis vulnerability allows users with access to one namespace to read and write files in other namespaces within the same lakeFS deployment.\n\n## Impact\n\nAuthenticated lakeFS users can:\n\n- **Read and write files in sibling directories** that share the same path prefix as the storage directory (vulnerability 1)\n- **Access files across namespaces** by using path traversal in object identifiers (vulnerability 2)\n\nThis could allow attackers to:\n\n- Read sensitive data from other repositories/namespaces\n- Write malicious files to other namespaces\n- Read/write files in adjacent directories outside lakeFS storage\n- Potentially escalate privileges if writable directories are used by other services\n\nThis vulnerability **only affects** deployments using the local block adapter. Deployments using S3, GCS, Azure, or other object storage backends are **not affected**.\n\n## Patches\n\nFixed in version v1.77.0.\n\nThe fixes:\n1. Append a path separator to prefix checks, ensuring paths must be within the storage directory\n2. Add two-level path validation: verify both that namespace paths stay within the adapter\u0027s base path AND that resolved paths stay within their designated namespace\n\n## Workarounds\n\n- Configure the storage path with a unique name unlikely to be a prefix of other directories\n- Restrict filesystem permissions for the lakeFS process\n- Ensure no sensitive data exists in sibling directories\n\n## Credit\n\nDiscovered via CodeQL static analysis.",
  "id": "GHSA-699m-4v95-rmpm",
  "modified": "2026-02-13T22:11:49Z",
  "published": "2026-02-13T16:16:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26187"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/treeverse/lakeFS"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/releases/tag/v1.77.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access"
}

FKIE_CVE-2026-26187

Vulnerability from fkie_nvd - Published: 2026-02-13 19:17 - Updated: 2026-02-13 21:43

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce
	security-advisories@github.com	https://github.com/treeverse/lakeFS/releases/tag/v1.77.0
	security-advisories@github.com	https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names. Also, the adapter verified that resolved paths stayed within the adapter\u0027s base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces. Fixed in version v1.77.0."
    }
  ],
  "id": "CVE-2026-26187",
  "lastModified": "2026-02-13T21:43:11.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-13T19:17:29.100",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/treeverse/lakeFS/releases/tag/v1.77.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-26187 (GCVE-0-2026-26187)

GHSA-699M-4V95-RMPM

Summary

Details

1. Prefix Bypass Vulnerability

2. Namespace Escape via Identifier

Impact

Patches

Workarounds

Credit

FKIE_CVE-2026-26187

Tags

Sightings

Nomenclature