Security Digest: March 26, 2026 - 12 Critical Vulnerabilities

Twelve critical vulnerabilities have emerged today, affecting popular software frameworks and libraries. Immediate patching and implementation of workarounds are essential to prevent potential remote code execution, privilege escalation, and denial-of-service attacks.

· 6 min read

Security Digest: March 26, 2026

Executive Summary

Twelve critical vulnerabilities have emerged today, affecting popular software frameworks and libraries. Immediate patching and implementation of workarounds are essential to prevent potential remote code execution, privilege escalation, and denial-of-service attacks.

Critical Vulnerabilities

  • CVE-2026-33696: Remote Code Execution in n8n
    • Impact: Exploitation allows attackers to execute arbitrary code on affected instances.
    • Affected Systems: n8n versions before 2.14.1, 2.13.3, 1.123.27.
    • Immediate Action: Upgrade to n8n versions 2.14.1, 2.13.3, or 1.123.27 immediately.
    • Mitigation: Restrict workflow permissions and disable XML nodes as a temporary measure.
  • CVE-2026-33757: OpenBao Authentication Bypass
    • Impact: Allows unauthorized access via remote phishing attacks.
    • Affected Systems: OpenBao versions prior to 2.5.2.
    • Immediate Action: Upgrade to OpenBao version 2.5.2.
    • Mitigation: Remove roles with `callback_mode=direct` or enforce session confirmation.
  • CVE-2026-33749: Cross-Site Scripting in n8n
    • Impact: Enables JavaScript execution in victim's session.
    • Affected Systems: n8n versions before 1.123.27, 2.13.3, 2.14.1.
    • Immediate Action: Update to the fixed versions.
    • Mitigation: Restrict user permissions and network access to n8n instances.
  • CVE-2026-33943: Code Injection in happy-dom
    • Impact: Remote code execution via JavaScript injection.
    • Affected Systems: happy-dom versions prior to v20.8.4.
    • Immediate Action: Disable JavaScript evaluation or apply input validation patches.
  • CVE-2026-33747: BuildKit Directory Traversal
    • Impact: Unauthorized file access and modification.
    • Affected Systems: BuildKit versions before v0.28.1.
    • Immediate Action: Upgrade to v0.28.1 or later.
  • CVE-2026-33744: Arbitrary Command Execution in BentoML
    • Impact: Malicious YAML configurations lead to command execution.
    • Affected Systems: BentoML versions up to 1.4.36.
    • Immediate Action: Apply input validation patches and avoid untrusted configurations.
  • CVE-2026-33895: Ed25519 Signature Malleability in node-forge
    • Impact: Potential bypass of signature verification.
    • Affected Systems: node-forge versions up to 1.3.3.
    • Immediate Action: Implement strict scalar validation patches.
  • CVE-2026-33894: RSASSA PKCS#1 v1.5 Forgery in node-forge
    • Impact: Signature forgery using low public exponent keys.
    • Affected Systems: node-forge versions up to 1.3.3.
    • Immediate Action: Apply patches to enforce strict PKCS#1 v1.5 verification.
  • CVE-2026-33891: DoS in node-forge via modInverse
    • Impact: Infinite loop causing service hang.
    • Affected Systems: node-forge all versions.
    • Immediate Action: Apply patches to handle zero-value inputs in modInverse.
  • CVE-2026-33870: Request Smuggling in Netty
    • Impact: Exploits HTTP parsing to inject requests.
    • Affected Systems: netty-codec-http all versions.
    • Immediate Action: Apply patches to enforce RFC compliance in HTTP parsing.
  • CVE-2026-33896: Certificate Validation Bypass in node-forge
    • Impact: Non-CA certificates accepted as CAs.
    • Affected Systems: node-forge all versions.
    • Immediate Action: Apply patches to enforce basicConstraints checks.
  • CVE-2026-33906: Privilege Escalation in Ellanetworks Core
    • Impact: Unauthorized database overwrite.
    • Affected Systems: Ellanetworks Core with NetworkManager role.
    • Immediate Action: Remove backup and restore permissions from NetworkManager role.

Previously Alerted

What to Do Now

  1. Immediately apply patches or implement workarounds for all critical vulnerabilities.
  2. Verify systems against latest patches and configurations for all affected software.
  3. Monitor network and application logs for unusual activity or exploitation attempts.

Related Resources

  • Official vendor advisories and patches on GitHub
  • Internal blog posts on mitigating specific vulnerabilities (to be published)

Keep reading