Security Digest: October 23, 2026 - 29 Critical Vulnerabilities

Today’s alert is dominated by remote compromise risk, account takeover paths, and multiple denial-of-service flaws across widely deployed developer tools, identity-sensitive apps, and infrastructure components. The most urgent items are the Obsidian TCP transport flaw, the end-of-life AWS Multi Model Server RCE, Twisted pre-auth memory exhaustion bugs, and the OpenReception and Misskey issues; patch or isolate exposed services immediately.

· 19 min read

Executive Summary

Today’s alert is dominated by remote compromise risk, account takeover paths, and multiple denial-of-service flaws across widely deployed developer tools, identity-sensitive apps, and infrastructure components. The most urgent items are the Obsidian TCP transport flaw, the end-of-life AWS Multi Model Server RCE, Twisted pre-auth memory exhaustion bugs, and the OpenReception and Misskey issues; patch or isolate exposed services immediately.

If you run internet-facing services, prioritize upgrades, temporary exposure reduction, and credential rotation where sensitive data may have been exposed. Several issues have no workaround beyond removal, upgrade, or strict proxy controls.

Critical Vulnerabilities

  • CVE-2026-77363: Obsidian tc HTTP transport loopback auth bypass
    • Impact: Drive-by web pages can reach local MCP services and gain full vault read/write access.
    • Affected Systems: npm obsidian-tc versions before 1.3.1.
    • Immediate Action: Upgrade now to >= 1.3.1 and review any deployment exposing the HTTP transport.
    • Mitigation: Do not use auth.mode: "none"; require JWT or place the service behind a proxy that validates Origin.
  • CVE-2026-115812: AWS Multi Model Server path traversal to RCE
    • Impact: Crafted model archives may allow remote code execution during extraction.
    • Affected Systems: Amazon Web Services Multi Model Server 1.1.11 and earlier.
    • Immediate Action: Stop using Multi Model Server and migrate to a supported model-serving platform.
    • Mitigation: No fixed version is available; treat this as end-of-life removal.
  • CVE-2026-115775: Twisted XMPP parser memory exhaustion
    • Impact: A single unauthenticated connection can exhaust memory and crash the process.
    • Affected Systems: Twisted before 26.10.0rc1.
    • Immediate Action: Upgrade Twisted immediately and restrict pre-auth XMPP exposure.
    • Mitigation: Apply version 26.10.0rc1 or later.
  • CVE-2026-103937: Misskey upload cleanup failure leads to storage exhaustion
    • Impact: Repeated uploads can exhaust disk or file descriptors and deny service.
    • Affected Systems: Misskey 13.0.0 through 2025.4.1 and 2025.5.0 through 2026.7.0.
    • Immediate Action: Upgrade to 2026.7.0 and monitor upload volume immediately.
    • Mitigation: Limit upload rates and review storage and file-descriptor headroom.
  • CVE-2026-104817: Misskey fetch-rss unauthenticated SSRF/resource exhaustion
    • Impact: Attackers can trigger outbound requests, heavy parsing, and internal probing.
    • Affected Systems: Misskey 12.112.1 through 2026.7.0.
    • Immediate Action: Upgrade to 2026.7.0 and restrict access to RSS-related endpoints.
    • Mitigation: Add rate limits and network egress controls until patched.
  • CVE-2026-104816: Misskey RSS link scheme validation failure
    • Impact: Malicious feed content can trigger script execution when users click links.
    • Affected Systems: Misskey 12.0.0 through 2026.7.0.
    • Immediate Action: Upgrade to 2026.7.0 and audit RSS widgets.
    • Mitigation: Disable untrusted feeds and train users not to trust feed links.
  • CVE-2026-58202: OpenReception Host-header account takeover
    • Impact: Attackers can hijack account-confirmation flows and take over accounts.
    • Affected Systems: OpenReception through v1.1.0; fixed in 2.0.0.
    • Immediate Action: Upgrade to 2.0.0 and inspect proxy Host-header handling now.
    • Mitigation: Enforce explicit tenant host allowlists at the proxy layer.
  • CVE-2026-87901: Registration module reflected XSS
    • Impact: Attackers can execute script in victims’ browsers.
    • Affected Systems: Affected registration module builds; version details not provided.
    • Immediate Action: Disable or restrict the registration surface until a fix is confirmed.
    • Mitigation: Sanitize reflected input and add strict content-security controls.
  • CVE-2026-79977: WireGuard endpoint spoofing on UDP transport
    • Impact: A spoofed packet can redirect tunnel traffic and disrupt availability.
    • Affected Systems: WireGuard implementation in subsys/net/lib/wireguard/wg.c; CONFIG_WIREGUARD experimental.
    • Immediate Action: Patch immediately and verify tunnel endpoints on all devices.
    • Mitigation: Apply the vendor fix that stops endpoint learning from unauthenticated packets.
  • CVE-2026-104937: Shopware HTML upload stored XSS leading to admin compromise
    • Impact: Admin token theft can lead to plugin installation and PHP code execution.
    • Affected Systems: Shopware 6.7.
    • Immediate Action: Restrict file uploads and review any uploaded HTML content immediately.
    • Mitigation: Patch Shopware, block HTML uploads, and enforce safe download serving headers.
  • CVE-2026-102204: WSL link-following privilege escalation
    • Impact: A local attacker can elevate privileges through improper link resolution.
    • Affected Systems: Windows Subsystem for Linux.
    • Immediate Action: Apply Microsoft updates and restrict local shell access where possible.
    • Mitigation: Patch promptly; no practical workaround is listed.
  • CVE-2026-79979: Zephyr arm64 TLB invalidation bypass
    • Impact: User code may retain access to stale memory mappings and read/write reused frames.
    • Affected Systems: arm64 builds with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING.
    • Immediate Action: Update affected firmware/kernel builds and treat user-space isolation as unsafe until patched.
    • Mitigation: Apply the TLBI fix and validate demand-paging configurations.
  • CVE-2026-115863: ConnMan DHCPv6 buffer overflow
    • Impact: An on-link attacker can crash connmand and potentially trigger memory corruption.
    • Affected Systems: ConnMan through 2.0.
    • Immediate Action: Patch immediately and reduce exposure to untrusted local networks.
    • Mitigation: Apply the vendor fix; no safe workaround is provided.
  • CVE-2026-115778: Twisted Telnet subnegotiation memory exhaustion
    • Impact: An unauthenticated peer can grow buffers until the process fails.
    • Affected Systems: Twisted before 26.10.0rc1.
    • Immediate Action: Upgrade immediately and disable Telnet services exposed to untrusted networks.
    • Mitigation: Apply 26.10.0rc1 or later.
  • CVE-2026-65825: OpenReception booking PIN brute-force takeover
    • Impact: Attackers can obtain booking access tokens and act as the client.
    • Affected Systems: OpenReception versions 2.1.0 and earlier.
    • Immediate Action: Restrict booking access and watch for repeated PIN attempts now.
    • Mitigation: No public patch was available at publication; increase throttling and detection.
  • CVE-2026-73054: Siyuan kernel WebSocket auth bypass
    • Impact: An unauthenticated caller can receive the kernel event stream.
    • Affected Systems: github.com/siyuan-note/siyuan/kernel.
    • Immediate Action: Patch the kernel service and block unauthenticated WebSocket access immediately.
    • Mitigation: Apply the vendor fix and add origin validation on /ws.
  • CVE-2026-115776: Twisted IRC buffer growth DoS
    • Impact: A remote unauthenticated connection can exhaust memory and drop all users.
    • Affected Systems: Twisted before 26.10.0rc1.
    • Immediate Action: Upgrade and limit IRC exposure to trusted networks only.
    • Mitigation: Apply the upstream fix in 26.10.0rc1.
  • CVE-2026-115570: Electron TLS trust block bypass risk
    • Impact: Apps may trust a TLS server using a now-blocked intermediate certificate.
    • Affected Systems: Electron before 45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16.
    • Immediate Action: Update Electron immediately across all shipped desktop apps.
    • Mitigation: No app-side workaround; patch runtime versions only.
  • CVE-2026-65824: OpenReception invite token replay
    • Impact: A captured invite token can be replayed to register an attacker-controlled passkey.
    • Affected Systems: OpenReception prior to 2.2.1.
    • Immediate Action: Upgrade to 2.2.1 and rotate any pending invite tokens.
    • Mitigation: Invalidate outstanding invites and monitor for replay attempts.
  • CVE-2026-105483: Node.js TLS hostname verification confusion with non-ASCII IPv4
    • Impact: A certificate may be accepted for the wrong IP endpoint.
    • Affected Systems: Node.js 26.x and 24.x.
    • Immediate Action: Update Node.js and avoid non-ASCII host literals in TLS clients.
    • Mitigation: Patch to the fixed release line and normalize host input.
  • CVE-2026-106069: Node.js TLS IP mismatch with leading-zero IPv4 literals
    • Impact: A certificate can validate against a different IP than intended.
    • Affected Systems: Node.js 26.x, 24.x, and 22.x.
    • Immediate Action: Upgrade Node.js and block ambiguous IP literals in application code.
    • Mitigation: Use canonical IP formats only; patch runtime now.
  • CVE-2026-110975: Kruize Autotune unauthenticated secret disclosure
    • Impact: Monitoring credentials can be read in cleartext and reused elsewhere.
    • Affected Systems: Kruize Autotune.
    • Immediate Action: Restrict network access immediately and rotate exposed datasource secrets.
    • Mitigation: Add authentication and patch serialization behavior.
  • CVE-2026-105482: Node.js DNS NUL-byte truncation in dns.resolve*
    • Impact: Hostname validation can be bypassed and resolve the wrong domain.
    • Affected Systems: Node.js 26.x, 24.x, and 22.x.
    • Immediate Action: Patch Node.js and audit any code that validates then resolves hostnames.
    • Mitigation: Treat NUL bytes as invalid input and upgrade runtime versions.
  • CVE-2026-110209: Stonewuu ai-fusion-video configuration secret disclosure
    • Impact: Authenticated non-admin users can steal API keys, proxy passwords, and mail credentials.
    • Affected Systems: Stonewuu ai-fusion-video through 1.2.0.
    • Immediate Action: Restrict access to config endpoints and rotate any exposed secrets now.
    • Mitigation: Add authorization checks and remove secret fields from API responses.
  • CVE-2026-110217: Lenve vhr password hash disclosure
    • Impact: Low-privileged users can retrieve other operators’ BCrypt hashes and profile data.
    • Affected Systems: Lenve vhr through commit 03abbd3.
    • Immediate Action: Limit access to /chat/hrs and prepare password resets for exposed accounts.
    • Mitigation: Patch authorization checks and rotate credentials if exposure is confirmed.
  • CVE-2026-115572: pypdf repeated object recovery slowdown
    • Impact: Crafted PDFs can cause long runtimes and resource exhaustion.
    • Affected Systems: pypdf before 6.21.2.
    • Immediate Action: Upgrade to 6.21.2 and sandbox PDF processing.
    • Mitigation: Apply the upstream fix and cap processing time.
  • CVE-2026-115586: virtualenv prompt command execution
    • Impact: A crafted prompt can execute commands in a user’s shell session.
    • Affected Systems: virtualenv 21.14.9 through 21.14.13.
    • Immediate Action: Upgrade immediately and avoid activating untrusted environments.
    • Mitigation: Use version 21.14.13 or later.
  • CVE-2026-115585: pypdf cross-reference recovery slowdown
    • Impact: Malformed PDFs can trigger repeated full-file recovery and long runtimes.
    • Affected Systems: pypdf before 6.21.2.
    • Immediate Action: Upgrade to 6.21.2 and isolate PDF ingestion pipelines.
    • Mitigation: Apply the patched parser and enforce file-size limits.
  • CVE-2026-115580: pypdf oversized xref table processing exhaustion
    • Impact: Crafted PDFs can consume excessive CPU and delay processing.
    • Affected Systems: pypdf before 6.21.2.
    • Immediate Action: Upgrade to 6.21.2 now.
    • Mitigation: Add PDF parsing limits and quarantine untrusted documents.

Previously Alerted

What to Do Now

  1. Patch or remove exposed services first. Start with Obsidian tc, Twisted, Misskey, Electron, Node.js, pypdf, virtualenv, Shopware, ConnMan, and any OpenReception deployments.
  2. Isolate services you cannot patch today. Put them behind strict proxies, block unauthenticated network access, and disable risky endpoints such as uploads, WebSockets, RSS fetchers, and Telnet/IRC listeners.
  3. Rotate secrets where disclosure is possible. Assume exposed API keys, tokens, passwords, and invite credentials may already be compromised.
  4. Verify versions and exposure now. Confirm patched releases, check public-facing ports, and review proxy rules for Host and Origin validation.
  5. Monitor aggressively for abuse. Watch for repeated upload attempts, brute-force PIN traffic, anomalous outbound requests, unusual WebSocket sessions, and memory or disk exhaustion events.

Verification steps: inventory affected products, compare installed versions against the fixed releases above, and confirm that any internet-facing instance is either patched or temporarily removed from service. For Node.js and Electron, verify all deployed runtimes and rebuild shipped apps where needed.

Monitoring recommendations: alert on 5xx spikes, process restarts, abnormal outbound DNS/HTTP traffic, large file uploads, repeated auth failures, and any sudden growth in memory, disk, or file-descriptor usage.

Related Resources

  • Internal blog posts: to be published on emergency patch prioritization, exposed-service triage, and secret rotation.
  • Official vendor advisories: Twisted, Misskey, Electron, Node.js, Shopware, OpenReception, Amazon Web Services Multi Model Server, ConnMan, and pypdf security notices.

Keep reading