{"resultsPerPage":12,"startIndex":0,"totalResults":12,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-05T12:48:17.764","vulnerabilities":[{"cve":{"id":"CVE-2022-41924","sourceIdentifier":"security-advisories@github.com","published":"2022-11-23T19:15:12.400","lastModified":"2026-06-17T05:04:04.347","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server. An attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node. All Windows clients prior to version v.1.32.3 are affected. If you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue."},{"lang":"es","value":"Una vulnerabilidad identificada en el cliente Tailscale de Windows permite que un sitio web malicioso reconfigure el daemon Tailscale \"tailscaled\", que luego puede usarse para ejecutar código de forma remota. En el cliente Tailscale de Windows, la API local estaba vinculada a un socket TCP local y se comunicaba con la GUI del cliente de Windows en texto plano sin verificación del encabezado del Host. Esto permitió que un sitio web controlado por un atacante visitado por el nodo volviera a vincular DNS a un servidor DNS controlado por un atacante y luego realizar solicitudes de API locales en el cliente, incluido el cambio del servidor de coordinación a un servidor de coordinación controlado por un atacante. Un servidor de coordinación controlado por un atacante puede enviar respuestas URL maliciosas al cliente, incluida la inserción de ejecutables o la instalación de un recurso compartido SMB. Estos permiten al atacante ejecutar código de forma remota en el nodo. Todos los clientes de Windows anteriores a la versión v.1.32.3 se ven afectados. Si está ejecutando Tailscale en Windows, actualice a la versión 1.32.3 o posterior para solucionar el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"tailscale","product":"tailscale","versions":[{"version":"< 1.32.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"cvssMetricV30":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-22T15:41:17.008228Z","id":"CVE-2022-41924","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-352"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tailscale:tailscale:*:*:*:*:*:*:*:*","versionEndExcluding":"1.32.3","matchCriteriaId":"F2CCEDE3-89FA-4B6C-9BDA-4045A0090908"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://emily.id.au/tailscale","source":"security-advisories@github.com","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://github.com/tailscale/tailscale/security/advisories/GHSA-vqp6-rc3h-83cp","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://tailscale.com/security-bulletins/#ts-2022-004","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://emily.id.au/tailscale","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://github.com/tailscale/tailscale/security/advisories/GHSA-vqp6-rc3h-83cp","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://tailscale.com/security-bulletins/#ts-2022-004","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-41925","sourceIdentifier":"security-advisories@github.com","published":"2022-11-23T19:15:12.487","lastModified":"2026-06-17T05:04:04.467","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue."},{"lang":"es","value":"Una vulnerabilidad identificada en el cliente Tailscale permite que un sitio web malicioso acceda a la API del mismo nivel, que luego puede usarse para acceder a las variables de entorno de Tailscale. En el cliente Tailscale, la API del mismo nivel era vulnerable a la nueva vinculación de DNS. Esto permitió que un sitio web controlado por un atacante visitado por el nodo volviera a vincular el DNS para la API del mismo nivel a un servidor DNS controlado por el atacante y luego realizar solicitudes de API del mismo nivel en el cliente, incluido el acceso a las variables de entorno Tailscale del nodo. Un atacante con acceso a la API del mismo nivel en un nodo podría usar ese acceso para leer las variables de entorno del nodo, incluidas las credenciales o secretos almacenados en las variables de entorno. Esto puede incluir claves de autenticación de Tailscale, que luego podrían usarse para agregar nuevos nodos a la red trasera del usuario. El acceso a la API de pares también podría usarse para conocer otros nodos en la tailnet o enviar archivos a través de Taildrop. Todos los clientes de Tailscale anteriores a la versión v1.32.3 se ven afectados. Actualice a v1.32.3 o posterior para solucionar el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"tailscale","product":"tailscale","versions":[{"version":"< 1.32.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-22T15:41:13.012397Z","id":"CVE-2022-41925","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tailscale:tailscale:*:*:*:*:*:*:*:*","versionEndExcluding":"1.32.3","matchCriteriaId":"F2CCEDE3-89FA-4B6C-9BDA-4045A0090908"}]}]}],"references":[{"url":"https://emily.id.au/tailscale","source":"security-advisories@github.com","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://github.com/tailscale/tailscale/security/advisories/GHSA-qccm-wmcq-pwr6","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://tailscale.com/security-bulletins/#ts-2022-005","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://emily.id.au/tailscale","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://github.com/tailscale/tailscale/security/advisories/GHSA-qccm-wmcq-pwr6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://tailscale.com/security-bulletins/#ts-2022-005","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2023-28436","sourceIdentifier":"security-advisories@github.com","published":"2023-03-23T20:15:15.487","lastModified":"2026-06-17T05:47:44.060","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules.\n\nTailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria: the destination node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users; and a non-interactive SSH session was used.\n\nAffected users should upgrade to version 1.38.2 to remediate the issue.\n\n"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"tailscale","product":"tailscale","versions":[{"version":">= 1.34.0, < 1.38.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-25T14:28:14.011420Z","id":"CVE-2023-28436","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tailscale:tailscale:*:*:*:*:*:*:*:*","versionStartIncluding":"1.34","versionEndExcluding":"1.38.2","matchCriteriaId":"627EF495-6BE7-4E49-95B1-2F6F67C153EF"}]}]}],"references":[{"url":"https://github.com/tailscale/tailscale/commit/d00c046b723dff6e3775d7d35f891403ac21a47d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/tailscale/tailscale/releases/tag/v1.38.2","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/tailscale/tailscale/security/advisories/GHSA-vfgq-g5x8-g595","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://tailscale.com/security-bulletins/#ts-2023-003","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/tailscale/tailscale/commit/d00c046b723dff6e3775d7d35f891403ac21a47d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/tailscale/tailscale/releases/tag/v1.38.2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes"]},{"url":"https://github.com/tailscale/tailscale/security/advisories/GHSA-vfgq-g5x8-g595","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"https://tailscale.com/security-bulletins/#ts-2023-003","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-29266","sourceIdentifier":"cve@mitre.org","published":"2025-03-31T13:15:43.250","lastModified":"2026-06-17T09:05:14.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled."},{"lang":"es","value":"Unraid 7.0.0 anterior a 7.0.1 permite a los usuarios remotos acceder a la interfaz web gráfica de Unraid y a la consola web como root sin autenticación si un contenedor se ejecuta en modo de red de host con la opción Usar Tailscale habilitada."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Unraid","product":"Unraid","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-31T13:03:38.770484Z","id":"CVE-2025-29266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-289"}]}],"references":[{"url":"https://docs.unraid.net/unraid-os/release-notes/7.0.1/","source":"cve@mitre.org"},{"url":"https://edac.dev/security/CVE-2025-29266/","source":"cve@mitre.org"},{"url":"https://github.com/unraid/webgui","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-32045","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-03-21T01:17:07.140","lastModified":"2026-06-17T10:35:00.490","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway routes without proper authentication credentials."},{"lang":"es","value":"Versiones de OpenClaw anteriores a 2026.2.21 aplican incorrectamente la autenticación de encabezado de Tailscale sin token a las rutas de puerta de enlace HTTP, permitiendo la omisión de los requisitos de token y contraseña. Atacantes en redes de confianza pueden explotar esta mala configuración para acceder a las rutas de puerta de enlace HTTP sin las credenciales de autenticación adecuadas."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.2.21","versionType":"semver","status":"affected"},{"version":"2026.2.21","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-23T16:42:26.773712Z","id":"CVE-2026-32045","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2026.2.21","matchCriteriaId":"09CAA52D-0C33-41B4-854A-338CBFC45513"}]}]}],"references":[{"url":"https://github.com/openclaw/openclaw/commit/356d61aacfa5b0f1d5830716ec59d70682a3e7b8","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hff7-ccv5-52f8","source":"disclosure@vulncheck.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/openclaw-authentication-bypass-in-http-gateway-routes-via-tokenless-tailscale-auth","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-30975","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T21:16:41.453","lastModified":"2026-06-17T10:33:15.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had disabled authentication for local addresses (Authentication Required set to: `Disabled for Local Addresses`) without a reverse proxy running in front of Sonarr that didn't not pass through the invalid header. Patches are available in version 4.0.16.2942 in the nightly/develop branch and version 4.0.16.2944 for stable/main releases. Some workarounds are available. Make sure Sonarr's Authentication Required setting is set to `Enabled`, run Sonarr behind a reverse proxy, and/or do not expose Sonarr directly to the internet and instead rely on accessing it through a VPN, Tailscale or a similar solution."},{"lang":"es","value":"Sonarr es un PVR para usuarios de Usenet y BitTorrent. Las versiones anteriores a la 4.0.16.2942 tienen una omisión de autenticación que afectaba a los usuarios que habían deshabilitado la autenticación para direcciones locales (Autenticación Requerida configurada como: 'Deshabilitada para Direcciones Locales') sin un proxy inverso ejecutándose delante de Sonarr que sí pasara la cabecera inválida. Los parches están disponibles en la versión 4.0.16.2942 en la rama nightly/develop y en la versión 4.0.16.2944 para las versiones stable/main. Algunas soluciones alternativas están disponibles. Asegúrese de que la configuración 'Autenticación Requerida' de Sonarr esté establecida en 'Habilitada', ejecute Sonarr detrás de un proxy inverso, y/o no exponga Sonarr directamente a internet y, en su lugar, confíe en acceder a él a través de una VPN, Tailscale o una solución similar."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Sonarr","product":"Sonarr","versions":[{"version":"< 4.0.16.2942","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-26T15:23:30.487188Z","id":"CVE-2026-30975","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sonarr:sonarr:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.16.2942","matchCriteriaId":"03480656-DD06-48B9-AB6B-40F751EDAA17"}]}]}],"references":[{"url":"https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2942","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2944","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h5qx-5hjf-7c9r","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-30976","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T21:16:41.623","lastModified":"2026-06-17T10:33:15.440","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and any user-accessible files on the same drive This issue only impacts Windows systems; macOS and Linux are unaffected. Files returned from the API were not limited to the directory on disk they were intended to be served from. This problem has been patched in 4.0.17.2950 in the nightly/develop branch or 4.0.17.2952 for stable/main releases. It's possible to work around the issue by only hosting Sonarr on a secure internal network and accessing it via VPN, Tailscale or similar solution outside that network."},{"lang":"es","value":"Sonarr es un PVR para usuarios de Usenet y BitTorrent. En versiones de la rama 4.x anteriores a la 4.0.17.2950, un atacante remoto no autenticado puede leer potencialmente cualquier archivo legible por el proceso de Sonarr. Estos incluyen archivos de configuración de la aplicación (que contienen claves de API y credenciales de base de datos), archivos del sistema de Windows y cualquier archivo accesible por el usuario en la misma unidad. Este problema solo afecta a los sistemas Windows; macOS y Linux no se ven afectados. Los archivos devueltos desde la API no estaban limitados al directorio en disco desde el que se suponía que debían servirse. Este problema ha sido parcheado en la versión 4.0.17.2950 en la rama nightly/develop o en la 4.0.17.2952 para las versiones stable/main. Es posible solucionar el problema alojando Sonarr únicamente en una red interna segura y accediéndolo a través de VPN, Tailscale o una solución similar fuera de esa red."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Sonarr","product":"Sonarr","versions":[{"version":">= 4.0, < 4.0.17.2950","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-26T17:53:23.067175Z","id":"CVE-2026-30976","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sonarr:sonarr:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0.741","versionEndExcluding":"4.0.17.2950","matchCriteriaId":"15A94C78-5072-4BB2-9E51-622ECBB2650B"}]}]}],"references":[{"url":"https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41913","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-04-28T19:37:45.103","lastModified":"2026-06-17T10:47:11.183","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rate-limit budget. Attackers can exploit this by sending multiple simultaneous authentication attempts to circumvent intended rate-limiting protections on Tailscale-capable paths."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.4.4","versionType":"semver","status":"affected"},{"version":"2026.4.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-29T12:46:26.346297Z","id":"CVE-2026-41913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2026.4.4","matchCriteriaId":"29FA0977-309A-40E9-87FE-FE1BB2466DB2"}]}]}],"references":[{"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-25wv-8phj-8p7r","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/openclaw-rate-limit-bypass-via-concurrent-async-authentication-attempts","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-41687","sourceIdentifier":"security-advisories@github.com","published":"2026-05-07T15:16:09.107","lastModified":"2026-10-26T20:10:00.160","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php (line 42) and endpoints/payments/add.php (line 40) uses an inline IP validation check (FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) that does not block CGNAT addresses (100.64.0.0/10, RFC 6598). The includes/ssrf_helper.php file explicitly defines is_cgnat_ip() to cover this gap (used by notification endpoints), but the logo/icon URL fetching in subscription and payment endpoints performs its own inline validation that misses this range. This allows authenticated users to perform Blind SSRF to internal services in Tailscale, Carrier-Grade NAT, and other environments using 100.64.0.0/10 addresses. This issue has been patched in version 4.8.1."},{"lang":"es","value":"Wallos es un rastreador personal de suscripciones de código abierto y autoalojable. Antes de la versión 4.8.1, la protección SSRF en endpoints/subscription/add.php (línea 42) y endpoints/payments/add.php (línea 40) utiliza una verificación de validación de IP en línea (FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) que no bloquea las direcciones CGNAT (100.64.0.0/10, RFC 6598). El archivo includes/ssrf_helper.php define explícitamente is_cgnat_ip() para cubrir esta brecha (utilizado por los endpoints de notificación), pero la obtención de URL de logotipos/iconos en los endpoints de suscripción y pago realiza su propia validación en línea que omite este rango. Esto permite a usuarios autenticados realizar SSRF Ciego a servicios internos en Tailscale, NAT de Grado de Operador y otros entornos que utilizan direcciones 100.64.0.0/10. Este problema ha sido parcheado en la versión 4.8.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"ellite","product":"Wallos","versions":[{"version":"< 4.8.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-07T14:56:20.647203Z","id":"CVE-2026-41687","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/ellite/Wallos/commit/e79f28be6be0435fbc93563fb3c0e62206b48e85","source":"security-advisories@github.com"},{"url":"https://github.com/ellite/Wallos/releases/tag/v4.8.1","source":"security-advisories@github.com"},{"url":"https://github.com/ellite/Wallos/security/advisories/GHSA-4v59-hghw-7gc2","source":"security-advisories@github.com"},{"url":"https://github.com/ellite/Wallos/security/advisories/GHSA-4v59-hghw-7gc2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-57999","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-06-29T19:16:42.857","lastModified":"2026-10-25T21:10:00.770","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing shell substitutions like $() to be evaluated by the outer shell before argument processing."},{"lang":"es","value":"luci-app-tailscale-community contiene una vulnerabilidad de inyección de comandos en el método RPC tailscale.do_login que permite a usuarios autenticados ejecutar comandos arbitrarios como root. La vulnerabilidad existe porque los parámetros loginserver y loginserver_authkey, controlados por el usuario, no están correctamente entrecomillados dentro de un comando de shell con comillas dobles, lo que permite que las sustituciones de shell como $() sean evaluadas por el shell externo antes del procesamiento de argumentos."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openwrt","product":"luci-app-tailscale-community","defaultStatus":"unaffected","repo":"https://github.com/openwrt/luci","packageURL":"pkg:github/openwrt/luci","versions":[{"version":"0","lessThanOrEqual":"0.11.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-30T13:16:48.896086Z","id":"CVE-2026-57999","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/luci-app-tailscale-community-command-injection-via-tailscale-do-login-rpc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-64175","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-19T16:17:59.750","lastModified":"2026-10-19T21:17:26.043","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: stop TX during firmware restart\n\nWhen iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel\nBE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart\nto true. However, iwl_mld_tx_from_txq() does not check this flag before\ndequeuing frames from mac80211 and pushing them to the transport layer.\n\nSince the firmware is dead, iwl_trans_tx() returns -EIO for each frame,\nwhich then gets freed immediately. Under high-throughput conditions\n(e.g., Tailscale UDP traffic or active SSH sessions), this creates a\ntight dequeue-send-fail-free loop that wastes CPU cycles and generates\nrapid skb allocation churn, leading to memory pressure from slab\nfragmentation.\n\nThe RX path already has this guard (iwl_mld_rx_mpdu checks\nin_hw_restart at rx.c:1906), and so does the TXQ allocation worker\n(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to\niwl_mld_tx_from_txq() to stop all TX during firmware restart.\n\nFrames left in mac80211's TXQs are naturally drained after restart\ncompletes, when queue reallocation triggers iwl_mld_tx_from_txq()\nvia iwl_mld_add_txq_list(), or when new upper-layer traffic invokes\nwake_tx_queue.\n\nTested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on\nkernel 6.19.5 where the firmware crashes approximately every 10-15\nminutes under Tailscale traffic."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"dc31c69476520bb4c2a208211a8d3c310a62c4d0","versionType":"git","status":"affected"},{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"13f1786395dbbf3df73337063c798f1266be6151","versionType":"git","status":"affected"},{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"2becb38a3e217ef2b2f42fddd7db7a25905ec291","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T15:37:10.586674Z","id":"CVE-2026-64175","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.34","matchCriteriaId":"89E9B97C-FD82-4D2E-8426-3A1A703B2ED7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.0.11","matchCriteriaId":"0520D091-FC52-4A50-AF07-70AE7D08B750"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-107060","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.933","lastModified":"2026-10-30T19:18:03.053","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:57:48.702391Z","id":"CVE-2026-107060","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://f-droid.org/packages/com.tailscale.ipn/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107060.md","source":"cve@mitre.org"},{"url":"https://github.com/tailscale/tailscale","source":"cve@mitre.org"},{"url":"https://tailscale.com/security-bulletins","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107060.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}]}