PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 72 By PatchDayAlert

CVSS 10 in PraisonAI's Claude workflow, plus two Cisco IOS XE crashers

A fork-based command injection lets any outside contributor run code in PraisonAI's GitHub Actions runners (CVE-2026-48168, CVSS 10). Two unauthenticated Cisco IOS XE DoS bugs (CVSS 8.6 each) can reload your routers with a single packet. Keycloak SAML bypass and a GStreamer memory bomb round out the day.

Patch now
1
Within 24h
3
This week
1
Exploited
0
PraisonAIGitHub ActionsCloudCisco IOSCisco IOS XENetwork ApplianceGStreamerGst Plugins GoodLinuxKeycloakRed Hat Build Of Keycloak

A perfect 10 just dropped. PraisonAI's bundled Claude GitHub Actions workflow lets any outside contributor inject shell commands through a branch name, giving them code execution on the Actions runner with write access to your repo. No exploits spotted in the wild yet, but the bar to pull this off is absurdly low. Behind that, two unauthenticated Cisco IOS XE denial-of-service bugs and a Keycloak SAML auth bypass round out a day you don't want to ignore.

Today's CVEs

Sorted by urgency

01

CVE-2026-48168

NVD
10.0
CVSS
Patch now CRITICAL
PraisonAIGitHub ActionsCloud

An attacker can open a pull request against any PraisonAI repo that uses the bundled Claude GitHub Actions workflow, stuff shell commands into the branch name, then comment @claude to trigger arbitrary code execution inside the Actions runner. Because the runner holds a GitHub App token with write permissions and OIDC access, the attacker can push code to the repo, manipulate issues and PRs, or steal OIDC tokens. No special access is needed: any outside contributor on a fork can pull this off.

Affected estate
Anyone running PraisonAI prior to 4.6.40 with the bundled Claude GitHub Actions workflow enabled on their repos
How to check
Search your .github/workflows/ directory for the Claude workflow file. Check your PraisonAI version (pip show praisonai). If the workflow exists and the version is below 4.6.40, you're exposed.
Included because
unauthenticated; internet-facing; CVSS 10.0; command injection in CI/CD pipeline; no interaction required beyond a comment
Action
Upgrade PraisonAI to 4.6.40+. Review recent Actions logs for fork-originated PRs with shell metacharacters in branch names.
Why it matters
CVSS 10.0: any anonymous GitHub user can execute arbitrary code with write access to your repository and steal OIDC tokens.
Source
PraisonAI GitHub advisory

Evidence trail

02

CVE-2026-20301

NVD
8.6
CVSS
Patch within 24h HIGH
Cisco IOSCisco IOS XENetwork Appliance

A remote, unauthenticated attacker can send a single malformed XMCP packet to a Cisco IOS or IOS XE device and crash it, forcing an unexpected reload. No credentials or knowledge of the XMCP client username is required. If you have XMCP (External Client protocol) enabled on any routers or switches, they're sitting ducks for a DoS.

Affected estate
Network engineers running Cisco IOS or IOS XE devices with XMCP enabled
How to check
Run 'show running-config | include xmcp' on your devices. If XMCP is configured, you're exposed. Also check your IOS/IOS XE version against Cisco's advisory.
Included because
unauthenticated; remote; network infrastructure; CVSS 8.6; device reload DoS
Action
Apply the fixed IOS/IOS XE release from Cisco. As a workaround, disable XMCP or apply an ACL to block untrusted XMCP traffic.
Why it matters
An unauthenticated attacker can remotely crash your network devices, causing outages across your infrastructure.
Source
Cisco Security Advisory

Evidence trail

03

CVE-2026-20263

NVD
8.6
CVSS
Patch within 24h HIGH
Cisco IOS XENetwork Appliance

A crafted BEEP SOAP request sent to a Cisco IOS XE device can crash it and force a reload, no authentication required. This is another unauthenticated remote DoS in IOS XE's protocol handling. If BEEP is reachable from untrusted networks, you need to act fast.

Affected estate
Network engineers running Cisco IOS XE devices with the BEEP feature exposed
How to check
Review your running config for BEEP-related configuration. Check your IOS XE version against Cisco's advisory for affected releases.
Included because
unauthenticated; remote; network infrastructure; CVSS 8.6; device reload DoS
Action
Upgrade to the patched IOS XE release. As a stopgap, apply ACLs to block untrusted access to BEEP services.
Why it matters
An unauthenticated attacker can remotely crash your switches or routers, causing network outages.
Source
Cisco Security Advisory

Evidence trail

04

CVE-2026-18649

NVD
7.5
CVSS
Patch this week HIGH
GStreamerGst Plugins GoodLinux

The H.264 and H.265 RTP depayloaders in GStreamer's gst-plugins-good package never cap the size of their reassembly buffer. A remote attacker can send a stream of RTP fragments that never finish, causing memory usage to grow until the process dies. Any application using GStreamer to receive RTP video streams (media servers, video conferencing apps, surveillance systems) is vulnerable.

Affected estate
Anyone running applications that use GStreamer's gst-plugins-good for RTP video processing, especially media servers, streaming platforms, and video conferencing systems on Linux
How to check
Run 'gst-inspect-1.0 rtph264depay' to confirm the plugin is installed, then check 'dpkg -l gstreamer1.0-plugins-good' or 'rpm -q gstreamer1-plugins-good' for the installed version.
Included because
unauthenticated; remote; common multimedia framework; CVSS 7.5; denial of service
Action
Update gst-plugins-good via your package manager or build from the latest upstream release that includes the fix.
Why it matters
An unauthenticated remote attacker can exhaust process memory and kill any GStreamer-based media application by sending crafted RTP fragments.
Source
Red Hat / GStreamer upstream advisory

Evidence trail

05

CVE-2026-16443

NVD
7.4
CVSS
Patch within 24h HIGH
KeycloakRed Hat Build Of KeycloakLinuxCloud

When Keycloak imports SAML identity provider metadata that doesn't include specific key usage attributes, it silently disables signature validation on SAML responses, even when a signing certificate is present. An unauthenticated attacker who knows a user's external identifier can forge a SAML response and log in as that user. This is a serious authentication bypass for anyone using SAML identity brokering in Keycloak.

Affected estate
Teams running Red Hat Build of Keycloak (or upstream Keycloak) with SAML identity brokering configured
How to check
In the Keycloak admin console, go to Identity Providers, select your SAML IdP, and check whether 'Validate Signatures' is actually enforced. Review your imported IdP metadata XML for missing 'use' attributes on KeyDescriptor elements.
Included because
unauthenticated; authentication bypass; internet-facing SSO; CVSS 7.4; SAML signature validation disabled silently
Action
Upgrade Keycloak to the patched release. After upgrading, re-import your SAML IdP metadata and confirm signature validation is active.
Why it matters
An attacker can forge SAML responses and take over user accounts without any credentials, bypassing your SSO entirely.
Source
Red Hat Security Advisory

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →