Security Digest: April 21, 2026 - 9 Critical Vulnerabilities
Today, nine critical vulnerabilities have been discovered affecting a range of software, from cloud drivers to XML parsers. Immediate action is required to patch systems and mitigate potential exploits that could lead to unauthorized command execution, code injection, and data exfiltration.
· 6 min read
Security Digest: April 21, 2026 - 9 Critical Vulnerabilities
Executive Summary
Today, nine critical vulnerabilities have been discovered affecting a range of software, from cloud drivers to XML parsers. Immediate action is required to patch systems and mitigate potential exploits that could lead to unauthorized command execution, code injection, and data exfiltration.
Critical Vulnerabilities
- CVE-2026-32604: Arbitrary Command Execution in Clouddriver
- Impact: Attackers can execute arbitrary commands, exposing credentials or modifying resources.
- Affected Systems: Maven io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo
- Immediate Action: Disable the gitrepo artifact types.
- Mitigation: Evaluate dependencies and apply vendor patches.
- CVE-2026-39386: Admin Control Vulnerability in Neko
- Impact: Authenticated users can gain full administrative control.
- Affected Systems: Neko Server v3.0.0 to v3.1.1
- Immediate Action: Upgrade to v3.0.11 or v3.1.2 immediately.
- Mitigation: Restrict access to trusted users and monitor for suspicious activity.
- CVE-2026-35570: Path Traversal in BashTool
- Impact: Bypass filesystem restrictions and read/write arbitrary files.
- Affected Systems: npm @gitlawb/openclaude
- Immediate Action: Apply the recommended code fix to prevent path traversal.
- Mitigation: Validate paths rigorously and disable sandbox auto-allow settings.
- CVE-2026-25524: RCE via Phar in OpenMage
- Impact: Potential for arbitrary code execution through malicious file uploads.
- Affected Systems: OpenMage LTS < 20.16.1
- Immediate Action: Upgrade to the latest version or apply the recommended path validation.
- Mitigation: Disable 'phar://' stream wrapper and implement strict file validation.
- CVE-2026-40161: Git Token Leakage in Tekton Pipelines
- Impact: Exfiltration of shared Git API tokens to attacker-controlled endpoints.
- Affected Systems: Tekton Pipelines v1.0.0 to v1.10.0
- Immediate Action: Require user-provided tokens and restrict TaskRun creation.
- Mitigation: Apply egress network policies to limit external communications.
- CVE-2026-33626: SSRF in LMDeploy
- Impact: Unauthorized access to internal resources and cloud services.
- Affected Systems: LMDeploy versions prior to 0.12.3
- Immediate Action: Implement URL validation before making requests.
- Mitigation: Use blocklists for internal IP ranges.
- CVE-2026-39320: ReDoS in SignalK Server
- Impact: Server denial of service through crafted WebSocket messages.
- Affected Systems: npm signalk-server
- Immediate Action: Patch the server to handle regex safely.
- Mitigation: Limit regex usage and validate inputs thoroughly.
- CVE-2026-41066: XXE in lxml
- Impact: Untrusted XML input can lead to local file access.
- Affected Systems: lxml < 6.1.0
- Immediate Action: Upgrade to lxml 6.1.0 or set `resolve_entities` to 'internal'.
- Mitigation: Disable entity resolution by default in XML parsers.
- CVE-2026-40938: Git Resolver Argument Injection
- Impact: Arbitrary code execution on resolver pods.
- Affected Systems: Tekton Pipelines with git resolver
- Immediate Action: Validate `revision` parameters and restrict local path usage.
- Mitigation: Implement strict validation and restrict service account privileges.
Previously Alerted
What to Do Now
- Patch affected systems immediately using the provided links and instructions.
- Verify that all changes have been applied by checking system logs and configurations.
- Continuously monitor for any suspicious activities or anomalies post-patch.
Related Resources
- Stay tuned for our upcoming blog posts on these vulnerabilities for deeper insights and analyses.
- Check the official GitHub advisories for detailed vendor recommendations.