CoverageArchiveRelease emailSecurity alertsStatus pagesNews digestMembership
Sign inGet the 07:40
ADVISORYCRITICAL6d ago · Sep 10, 2026

Traefik HTTP/3 Backend NTLM Connection Reuse

Traefik HTTP/3 users are exposed to backend NTLM and Negotiate connection reuse.

Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS…

Read it at github.com/traefik/traefik/v3

More advisory

4 itemsEverything on the wire ›
ADVISORY
CRITICAL: @zereight/mcp-gitlab — @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
The SSE transport mode (SSE=true) exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and uploads them to a GitLab project.…
@zereight/mcp-gitlab
6h
ADVISORY
HIGH: @zereight/mcp-gitlab — @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
@zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be…
@zereight/mcp-gitlab
21h
ADVISORY
CRITICAL: @zereight/mcp-gitlab — @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5…
@zereight/mcp-gitlab
23h
ADVISORY
HIGH: org.http4s:http4s-ember-server_2.12 — Http4s: DigestAuth nonce map grows unbounded
The DigestAuth server middleware's stale-nonce cleanup uses an inverted comparison: it removes fresh nonces and stops at the first stale one. Because a new nonce is created for every unauthenticated challenge, an attacker can drive the nonce map to grow…
org.http4s:http4s-ember-server_2.12
1d