Our S.O.S. line:
+49 89 262 025954
Our team of experts is ready to assist your organization in the event of a cyberattack.
details
The issue was addressed in the release of version 1.10.1 on 24th June, which contained many security updates, but known Proof-of-Concepts (PoC) and the fact that the vulnerability was added to the CISA Known Exploited Vulnerabilites Catalog (KEV) has significantly increased the risk of those unaware, also increasing it’s Exploit Prediction Scoring System (EPSS) score to an unusually high 17%. What makes the vulnerability particularly troublesome is that it does not require any authentication and lead to a Remote Code Execution (RCE).
The vulnerability chains two existing flaws. The first one is that a request “GET /api/v1/auto_login” generates a SUPERUSER JWT to any caller. Worth noting that this only happens with default configuration when AUTO_LOGIN is enabled. Additionally, if cross-origin resource sharing (CORS) is not configured properly, it may allow the JWT tokens to be exposed to unintended origins which also increases the risk of unauthorized access. The second one is that a request “POST /api/v1/validate/code” passes user-supplied Python to exec() with no sandbox.
These two separately could already cause troubles like information disclosure by unauthenticated access to a read-only API through SUPERUSER auto_login and privilege escalation for authenticated user through the Python exec() with no sandbox but together they lead to an unauthenticated RCE.
For more information you should check IBM’s own report on the issue and if you are interested, take a look at a POC:
Do you want to be protected from attacks like the above? See our defensive services here: Managed Security – White Hat IT Security
This week’s CVE of the Week is CVE-2026-63077, an unauthenticated remote code execution vulnerability in JetBrains TeamCity. It is a deserialization issue in the popular CI/CD service, which leads to executing system commands in the operating system with recently published [...]
