{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/padloc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:padloc:padloc:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-126570"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Padloc (\u003c 4.3.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Padloc"],"content_html":"\u003cp\u003ePadloc versions 4.0.0 through 4.3.0 contain a prototype pollution vulnerability in the \u003ccode\u003eScimServer._handleScimUsersPatch()\u003c/code\u003e function. An attacker possessing a valid SCIM token can exploit this by submitting crafted PATCH requests containing malicious paths, such as \u003ccode\u003e__proto__.x\u003c/code\u003e or \u003ccode\u003econstructor.prototype.x\u003c/code\u003e. These inputs are processed by the \u003ccode\u003esetPath()\u003c/code\u003e method, resulting in the pollution of the global \u003ccode\u003eObject.prototype\u003c/code\u003e. This modification affects the shared server process, potentially leading to service disruption for all organizations hosted on the affected instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the modification of the base JavaScript object prototype, which can alter the behavior of the entire Node.js process. This may result in widespread service disruption for all users or organizations sharing the vulnerable server instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Padloc to version 4.3.1 or later immediately to address CVE-2026-126570.\u003c/li\u003e\n\u003cli\u003eRestrict the issuance and management of SCIM tokens to trusted administrators and automate rotation to minimize the risk of unauthorized access.\u003c/li\u003e\n\u003cli\u003eAudit SCIM PATCH request logs for suspicious path parameters matching patterns like \u003ccode\u003e__proto__\u003c/code\u003e or \u003ccode\u003econstructor\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:54:00Z","date_published":"2026-11-11T13:54:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-padloc-prototype-pollution-cve-2026-126570/","summary":"Padloc versions 4.0.0 through 4.3.0 are vulnerable to prototype pollution via crafted SCIM PATCH requests, allowing authenticated attackers to modify Object.prototype and disrupt server processes.","title":"Padloc: Prototype pollution vulnerability in SCIM API (CVE-2026-126570)","url":"https://feed.craftedsignal.io/briefs/2026-11-padloc-prototype-pollution-cve-2026-126570/"}],"language":"en","title":"CraftedSignal Threat Feed - Padloc","version":"https://jsonfeed.org/version/1.1"}