Security Digest: April 2, 2026 - 12 Critical Vulnerabilities

Today, twelve critical vulnerabilities have been identified, impacting a range of systems from Juju controllers to PraisonAI applications.

· 7 min read

Security Alert: April 2, 2026

Executive Summary

Today, twelve critical vulnerabilities have been identified, impacting a range of systems from Juju controllers to PraisonAI applications. Immediate patching and mitigation efforts are required to prevent potential exploitation, including unauthorized access, data breaches, and system takeovers.

Critical Vulnerabilities

  • CVE-2026-4370: Unauthenticated Access in Juju Controllers
    • Impact: Attacker can join Dqlite cluster, escalate privileges, and open firewall ports.
    • Affected Systems: Juju versions 3.2.0 to 4.0.4
    • Immediate Action: Upgrade to Juju versions 3.6.20 or 4.0.5.
    • Mitigation: Configure restrictive firewall rules and use trusted networks.
  • CVE-2026-34938: Sandbox Bypass in PraisonAI Agents
    • Impact: Remote code execution via attacker-controlled Python code.
    • Affected Systems: PraisonAI Agents
    • Immediate Action: Apply patches from PraisonAI.
    • Mitigation: Avoid untrusted input in execute_code().
  • CVE-2026-34934: SQL Injection in PraisonAI
    • Impact: Full database access and data manipulation.
    • Affected Systems: PraisonAI via pip
    • Immediate Action: Sanitize inputs and apply latest security patches.
    • Mitigation: Review and secure all database queries.
  • CVE-2026-34953: Token Validation Flaw in PraisonAI
    • Impact: Unauthorized access with arbitrary tokens.
    • Affected Systems: PraisonAI
    • Immediate Action: Update token validation logic to reject unknown tokens.
    • Mitigation: Implement stricter token management practices.
  • CVE-2026-34952: Unauthenticated Access in PraisonAI Gateway
    • Impact: Unrestricted access to WebSocket and agent enumeration.
    • Affected Systems: PraisonAI Gateway
    • Immediate Action: Implement authentication checks for WebSocket connections.
    • Mitigation: Apply suggested code fixes to enforce authentication.
  • CVE-2026-34955: Sandbox Escape in PraisonAI
    • Impact: OS-level command execution via shell command injection.
    • Affected Systems: PraisonAI sandbox environments
    • Immediate Action: Replace shell=True with safer alternatives in subprocess calls.
    • Mitigation: Use shlex.split() to sanitize command inputs.
  • CVE-2026-34940: Command Injection in Kubernetes Model Server
    • Impact: Arbitrary code execution in model server pods.
    • Affected Systems: KubeAI
    • Immediate Action: Sanitize model URL inputs and remove reliance on bash -c.
    • Mitigation: Implement input validation and restrict shell use.
  • CVE-2026-34954: SSRF in PraisonAI Agents
    • Impact: Unrestricted internal network access, potential data exfiltration.
    • Affected Systems: PraisonAI Agents
    • Immediate Action: Validate URL inputs and block internal IP ranges.
    • Mitigation: Update code to enforce URL validation and restrictions.
  • CVE-2026-4800: Template Injection in Lodash
    • Impact: Remote code execution through template compilation.
    • Affected Systems: Lodash and related packages
    • Immediate Action: Upgrade to Lodash 4.18.0.
    • Mitigation: Avoid untrusted input in template imports.
  • CVE-2026-34783: Path Traversal in Ferret IO::FS::WRITE
    • Impact: Arbitrary file write leading to remote code execution.
    • Affected Systems: Ferret
    • Immediate Action: Implement path sanitization and base directory enforcement.
    • Mitigation: Apply suggested code fixes to prevent path traversal.
  • CVE-2026-34936: SSRF in PraisonAI Passthrough
    • Impact: Unauthorized requests to internal services and metadata endpoints.
    • Affected Systems: PraisonAI
    • Immediate Action: Validate API base URLs and restrict access to internal services.
    • Mitigation: Implement network access controls and input validation.
  • CVE-2026-34828: Session Management Weakness in Listmonk
    • Impact: Persistent unauthorized access after password changes.
    • Affected Systems: Listmonk
    • Immediate Action: Revoke sessions upon password changes.
    • Mitigation: Enhance session management to ensure security.

What to Do Now

  1. Immediately apply patches and updates for all affected systems.
  2. Verify all firewall and access control configurations.
  3. Monitor logs for any unauthorized access attempts.

Related Resources

Keep reading