CVE-2026-107589

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Weakness enumeration

CWE-290

Affected software

VendorProductVersions
Jacamar CIJacamar CI< 0.30.0

References

Timeline

Published
Oct 8, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-107595.5A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search CVE-2026-1075901.9An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and eaCVE-2026-10759410.0The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data CVE-2026-1075975.1PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows theCVE-2026-10764.3The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This iCVE-2026-1076027.5A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs wheCVE-2026-1076044.9A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm adminisCVE-2026-1076056.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could alCVE-2026-1076066.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could alCVE-2026-1076076.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could alCVE-2026-1076085.5Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-deCVE-2026-1076117.1An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromi
CVE-2026-107589: High severity, CVSS 7.5 | Vulnix