CVE-2026-93685

MediumCVSS 5.4/10Last modified Sep 21, 2026

Description

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 21, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-936877.5braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeplCVE-2026-936887.5SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowCVE-2026-936895.5WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that failsCVE-2026-93695.3A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function _discover_dashboard_plugins of the fileCVE-2026-936907.5uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment CVE-2026-936936.5In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafCVE-2026-936944.0In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callCVE-2026-936957.4In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local teCVE-2026-936979.0There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.CVE-2026-936989.9Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.CVE-2026-936998.5Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.CVE-2026-93703.7A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecr