Security Digest: February 11, 2026 - 2 Critical Vulnerabilities

Today's security landscape highlights two critical vulnerabilities that demand immediate attention. These flaws pose significant risks, including unauthorized account creation and privilege escalation.

· 3 min read

Today's Critical Security Alerts

Today's security landscape highlights two critical vulnerabilities that demand immediate attention. These flaws pose significant risks, including unauthorized account creation and privilege escalation, affecting widely-used systems. Immediate patching and stringent access reviews are essential.

Critical Vulnerabilities

  • CVE-2026-25759: Stored XSS Leads to Unauthorized Admin Creation
    • Impact: Allows authenticated users to inject malicious JavaScript, potentially leading to the creation of super admin accounts.
    • Affected Systems: composer statamic/cms (prior to version 6.2.3)
    • Immediate Action: Update to version 6.2.3 immediately.
    • Mitigation: Apply the available patch from the vendor. Review user permissions to ensure only trusted users have content creation rights.
  • CVE-2026-26010: JWT Leak Enables Privilege Escalation
    • Impact: Read-only users can escalate privileges, leading to potential data leaks and unauthorized destructive changes.
    • Affected Systems: maven org.open-metadata:openmetadata-sdk
    • Immediate Action: Implement role-based filtering to restrict JWT access. Redact JWT tokens in API responses.
    • Mitigation: Rotate Ingestion Bot Tokens and apply patches as provided by the vendor. Conduct access audits to ensure minimal exposure.

What to Do Now

  1. Immediately apply available patches for statamic/cms and openmetadata-sdk.
  2. Review and update user permissions to ensure secure access rights.
  3. Rotate and secure JWT tokens to prevent unauthorized access.
  4. Monitor system logs for unusual activity indicating exploitation attempts.

Related Resources

Keep reading