CVE-2026-28625
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil
CVSS
7.8
High
EPSS
0.1%
p0
KEV
—
Exploit Today
0
0-100
Published: Oct 5, 2026 · Last modified: Oct 6, 2026 · CWE-269
0.1%EPSS · 30 days0.1%
2026-10-062026-10-21
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1140698.1 HIG16.5%
——0Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.1dCVE-2026-1053129.9 CRI25.7%
——0A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.2dCVE-2026-869333.3 LOW2.7%
——1A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.2dCVE-2026-869216.2 MED3.4%
——1A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.2dCVE-2026-288537.8 HIG3.3%
——2The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.1dCVE-2026-1054538.4 HIG0.6%
——0IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.1d