Security Digest: May 21, 2026 - 7 Critical Vulnerabilities

Today’s alert is dominated by remote code execution, authentication bypass, and injection flaws across Netatalk, Honeywell CNM, authentik, Gmission Web Fax, and Mattermost. The most urgent risks are the Netatalk heap overflow, Honeywell command injection, and authentik SAML authentication bypass; patch or isolate exposed systems immediately.

· 8 min read

Executive Summary

Today’s alert is dominated by remote code execution, authentication bypass, and injection flaws across Netatalk, Honeywell CNM, authentik, Gmission Web Fax, and Mattermost. The most urgent risks are the Netatalk heap overflow, Honeywell command injection, and authentik SAML authentication bypass; patch or isolate exposed systems immediately.

If any of these products are internet-facing or used for identity, file sharing, fax services, or admin workflows, treat them as high-priority today.

Critical Vulnerabilities

CVE-2026-44050: Netatalk cnid daemon heap buffer overflow

  • Impact: Attackers may trigger a heap buffer overflow in the cnid daemon and potentially execute code or crash the service.
  • Affected Systems: Netatalk 2.0.0 through 4.4.2
  • Immediate Action: Identify all Netatalk deployments and prioritize any exposed AFP/file-sharing servers. Apply the fixed release immediately.
  • Mitigation: Upgrade to 4.4.3. If patching is delayed, restrict network access to trusted hosts only and disable unnecessary Netatalk services.

CVE-2026-5433: Honeywell CNM web interface command injection

  • Impact: An attacker could inject commands through the web interface and potentially achieve remote code execution.
  • Affected Systems: Honeywell Control Network Module (CNM) deployments affected by the advisory
  • Immediate Action: Assume exposed CNM web interfaces are at risk. Remove internet exposure, restrict admin access, and patch as soon as vendor guidance is available.
  • Mitigation: Apply the vendor fix or compensating controls immediately; place the interface behind VPN/allowlists and review for suspicious admin activity.

CVE-2026-44047: Netatalk mysql cnid backend SQL injection

  • Impact: Attackers may manipulate backend queries, leading to data access, service compromise, or further exploitation.
  • Affected Systems: Netatalk 3.1.0 through 4.4.2
  • Immediate Action: Patch all affected Netatalk instances and verify the mysql cnid backend is not reachable from untrusted networks.
  • Mitigation: Upgrade to 4.4.3. Until patched, restrict access to the backend and monitor logs for abnormal query patterns.

CVE-2026-40165: authentik SAML NameID XML comment injection authentication bypass

  • Impact: An attacker with a valid account on a connected SAML source could impersonate other users and gain access to their accounts.
  • Affected Systems: authentik 2025.12.4 and prior, and 2026.2.0-rc1 through 2026.2.2
  • Immediate Action: Patch immediately if you use SAML sources and XML signing. Review for suspicious logins and account access anomalies.
  • Mitigation: Upgrade to 2025.12.5 or 2026.2.3. Where possible, temporarily tighten SAML trust relationships and review NameID handling.

CVE-2026-9157: Gmission Web Fax dangerous file upload leading to remote code inclusion

  • Impact: Attackers may upload dangerous files and achieve remote code inclusion on affected systems.
  • Affected Systems: Gmission Web Fax 3.0 before 3.1
  • Immediate Action: Block untrusted uploads immediately and patch the Web Fax service before further use.
  • Mitigation: Upgrade to 3.1. If you cannot patch now, disable upload features and isolate the service from public access.

CVE-2026-4858: Mattermost integration URL path traversal

  • Impact: A malicious authenticated user could abuse path traversal to call arbitrary APIs using a system admin Mattermost auth token.
  • Affected Systems: Mattermost 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14
  • Immediate Action: Patch immediately and review integrations, especially any that accept user-controlled action URLs.
  • Mitigation: Upgrade to the vendor-fixed release for your branch. Limit integration permissions and audit admin-token usage.

CVE-2026-44058: Netatalk authentication bypass via admin auth user

  • Impact: Attackers may bypass authentication and gain unauthorized administrative access.
  • Affected Systems: Netatalk 2.2.2 through 4.4.2
  • Immediate Action: Treat any Netatalk admin-facing service as exposed until patched; restrict access and rotate credentials if compromise is suspected.
  • Mitigation: Upgrade to 4.5.0. Until then, isolate the service and monitor for unexpected admin logins.

Previously Alerted

What to Do Now

  1. Patch the highest-risk services first: Netatalk, authentik, Honeywell CNM, Gmission Web Fax, and Mattermost.
  2. Remove public exposure: Put admin consoles behind VPN, allowlists, or internal-only networks until patched.
  3. Validate versions: Confirm whether you are running any affected release ranges listed above.
  4. Review authentication and admin logs: Look for unusual SAML logins, admin token use, file uploads, and integration calls.
  5. Contain if patching is delayed: Disable vulnerable features, isolate hosts, and rotate credentials where privilege abuse is possible.

Verification steps: inventory affected products, confirm upgrade completion, and re-check service banners and package versions after maintenance. For identity and admin platforms, verify no unauthorized accounts, tokens, or SAML assertions were used during the exposure window.

Monitoring recommendations: watch for repeated crashes, unexpected web commands, suspicious uploads, path traversal attempts, and abnormal authentication patterns. Alert on any new admin sessions or API calls that do not match normal operations.

Related Resources

  • Internal blog posts: add links to your incident response and patch verification guidance here.
  • Official vendor advisories: Netatalk 4.4.3 / 4.5.0 release notes, authentik security advisory for 2025.12.5 and 2026.2.3, Mattermost MMSA-2026-00640, Honeywell CNM advisory, Gmission Web Fax advisory.

Keep reading