Security Digest: February 13, 2026 - 2 Critical Vulnerabilities

Developers and security teams must address two high-severity vulnerabilities immediately to prevent unauthorized data access and mitigate brute force risks.

· 3 min read

Today's Critical Cybersecurity Threats

Developers and security teams must address two high-severity vulnerabilities immediately to prevent unauthorized data access and mitigate brute force risks.

Critical Vulnerabilities

CVE-2026-26187: Path Traversal in lakeFS Local Block Adapter

  • Impact: Authenticated users can read/write files outside designated storage, potentially accessing sensitive data and escalating privileges.
  • Affected Systems: Deployments using the local block adapter in github.com/treeverse/lakefs.
  • Immediate Action: Upgrade to lakeFS version v1.77.0.
  • Mitigation: Configure a unique storage path, restrict filesystem permissions, and ensure no sensitive data resides in sibling directories.

CVE-2025-23368: Brute Force Vulnerability in WildFly Elytron Integration

  • Impact: Increased susceptibility to brute force attacks due to insufficient failed login attempt handling.
  • Affected Systems: WildFly Core 31.0.3.Final and WildFly 39.0.1.Final.
  • Immediate Action: Upgrade to WildFly Core 31.0.3.Final or WildFly 40 (Beta available).
  • Mitigation: Monitor network traffic and block suspicious activities.

What to Do Now

  1. Upgrade lakeFS: Ensure your deployment uses the latest version, v1.77.0, to fix path traversal issues.
  2. Secure WildFly: Update to WildFly Core 31.0.3.Final or test WildFly 40 Beta to mitigate brute force risks.
  3. Verification: Confirm upgrades by checking version numbers in your deployment environments.
  4. Monitoring: Deploy network monitoring tools to detect and block unusual access patterns.

Related Resources

Keep reading