CVE WatchAug 10, 2026

CVE-2026-14450

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging

CVSS

9.9

Critical

EPSS

—

KEV

—

Exploit Today

0-100

Published: Aug 10, 2026 · Last modified: Aug 10, 2026 · CWE-290

EPSS · 30d

Not enough EPSS history yet.

Technical description

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-186397.3 HIG

—

———When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.8h CVE-2026-189729.6 CRI

—

———An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.10h CVE-2026-61815.9 MED

—

——0The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account.9h CVE-2026-646658.1 HIG

23.5%

——7Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.4d CVE-2026-655708.1 HIG

14.3%

——4Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.5d CVE-2026-655025.3 MED

15.0%

——5Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.5d