Skip to content
Threat Feed
Subscribe

Tag

Auth-Bypass

2 briefs RSS
critical advisory

Rclone Unauthenticated options/set Allows Runtime Auth Bypass

Rclone is vulnerable to an unauthenticated options/set vulnerability that allows runtime authentication bypass, potentially leading to sensitive operations and command execution by setting `rc.NoAuth=true` on reachable RC servers started without global HTTP authentication.

rclone auth-bypass rc-api CVE-2026-41176 command-execution
2r 3t
high advisory

GitLab MCP Server Unauthenticated Access via SSE Transport

The @yoda.digital/gitlab-mcp-server's SSE transport lacks authentication and uses wildcard CORS, enabling unauthenticated attackers to execute arbitrary GitLab API calls using the operator's GitLab PAT, including destructive operations.

@yoda.digital/gitlab-mcp-server gitlab auth-bypass sse cors vulnerability
2r 2t