---METADATA---
VENDOR: AdGuard
PRODUCT: AdGuard Home
AFFECTED_VERSIONS: Prior to 0.107.73
---END_METADATA---

Description Summary:
AdGuard Home is vulnerable to an unauthenticated authentication bypass via HTTP/2 cleartext (h2c) upgrades, allowing attackers to process requests as fully authenticated.

Executive Summary:
A critical authentication bypass in AdGuard Home allows unauthenticated attackers to gain full administrative access by exploiting a flaw in HTTP/2 protocol handling.

Vulnerability Details

CVE-ID: CVE-2026-32136

Affected Software: AdGuard Home

Affected Versions: Prior to 0.107.73

Vulnerability: The vulnerability exists in the way AdGuard Home handles HTTP/1.1 requests that upgrade to HTTP/2 cleartext (h2c). The resulting connection bypasses the authentication middleware, allowing all subsequent HTTP/2 requests on that connection to be treated as fully authenticated without any credentials.

Business Impact

Attackers can gain complete control over network-wide ad-blocking and DNS settings, enabling them to redirect traffic to malicious sites or disable security protections. The CVSS score of 9.8 reflects the high severity of losing administrative control over a central network security component.

Remediation Plan

Immediate Action: Update AdGuard Home to version 0.107.73 or later to resolve the authentication middleware flaw.

Proactive Monitoring: Check logs for HTTP/1.1 to h2c upgrade requests and review DNS configuration history for unauthorized changes.

Compensating Controls: Disable HTTP/2 cleartext support if possible, or use a reverse proxy that properly handles authentication before passing traffic to the AdGuard Home service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. This protocol-level bypass is sophisticated but highly effective, making it a critical risk for internet-facing instances.

Analyst Recommendation

Immediate patching is required to prevent unauthorized administrative access. Organizations and home users should ensure their AdGuard Home instances are updated to version 0.107.73 and should avoid exposing the management interface to the public internet.

---METADATA---
VENDOR: Plunk
PRODUCT: Plunk
AFFECTED_VERSIONS: Prior to 0.7.0
---END_METADATA---

Description Summary:
Plunk contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its SNS webhook handler, allowing attackers to make arbitrary outbound GET requests.

Executive Summary:
An unauthenticated SSRF vulnerability in Plunk allows attackers to probe internal network resources and potentially exfiltrate sensitive cloud metadata.

Vulnerability Details

CVE-ID: CVE-2026-32096

Affected Software: Plunk (Email Platform)

Affected Versions: Prior to 0.7.0

Vulnerability: A flaw in the Amazon Simple Notification Service (SNS) webhook handler allows an unauthenticated attacker to send crafted requests. This forces the server to initiate arbitrary outbound HTTP GET requests to any host, including internal services or cloud metadata endpoints (e.g., IMDS).

Business Impact

A successful SSRF attack can lead to the compromise of internal services not exposed to the internet and the theft of sensitive environment variables or cloud IAM credentials. The CVSS score of 9.3 highlights the significant risk to the confidentiality and security of the underlying AWS infrastructure.

Remediation Plan

Immediate Action: Update the Plunk platform to version 0.7.0 or higher immediately.

Proactive Monitoring: Monitor outbound network logs for unusual GET requests originating from the Plunk server, particularly those targeting internal IP ranges or the 169.254.169.254 metadata address.

Compensating Controls: Implement egress filtering to restrict the Plunk server's ability to communicate with internal network segments or sensitive cloud metadata services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. SSRF vulnerabilities are frequently used in cloud environments to escalate privileges by targeting instance metadata services.

Analyst Recommendation

The ability for an unauthenticated attacker to trigger outbound requests is a high-risk scenario. Administrators must apply the version 0.7.0 patch immediately and verify that the server's network permissions follow the principle of least privilege.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Before 2026.2.24
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.2.24 contain a sandbox network isolation bypass vulnerability allowing trusted operators to access other container networks.

Executive Summary:
OpenClaw is vulnerable to a critical network isolation bypass that allows authenticated operators to violate container boundaries and access restricted services.

Vulnerability Details

CVE-ID: CVE-2026-32038

Affected Software: OpenClaw

Affected Versions: Before 2026.2.24

Vulnerability: This flaw allows a trusted operator to join another container's network namespace by manipulating the docker.network parameter. By using container:<id> values, an attacker can bypass network hardening controls and reach services that should be isolated within other container namespaces.

Business Impact

While this exploit requires "trusted operator" (authenticated) status, it represents a significant breakdown of the security model in containerized environments. An insider threat or a compromised operator account could use this to pivot across the infrastructure, accessing sensitive services or data in supposedly isolated containers. The CVSS score of 9.8 reflects the high potential for lateral movement.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.2.24 or later to enforce proper network namespace isolation and prevent the bypass.

Proactive Monitoring: Audit container configuration changes and monitor for unusual inter-container network traffic that deviates from established security policies.

Compensating Controls: Implement strict IAM policies to limit who can modify container network parameters and use network-level micro-segmentation to provide defense-in-depth.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation. This vulnerability is particularly relevant for multi-tenant environments where network isolation is a primary security requirement.

Analyst Recommendation

Container escape and isolation bypasses are high-impact events. Even though authentication is required, the potential for lateral movement within a cloud or data center environment is severe. Apply the 2026.2.24 update immediately to maintain the integrity of your container security boundaries.

---METADATA---
VENDOR: Apache
PRODUCT: OFBiz
AFFECTED_VERSIONS: before 24.09.06
---END_METADATA---

Description Summary:
Apache OFBiz contains a vulnerability involving the use of hard-coded cryptographic keys, which could allow unauthorized decryption or manipulation of sensitive data.

Executive Summary:
A critical hard-coded cryptographic key vulnerability in Apache OFBiz poses a severe risk of data compromise and unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-31986

Affected Software: Apache OFBiz

Affected Versions: before 24.09.06

Vulnerability: This vulnerability involves the presence of hard-coded cryptographic keys within the application, which may allow an unauthenticated attacker to bypass security controls or decrypt sensitive information.

Business Impact

With a CVSS score of 9.1, this vulnerability represents a critical risk to organizational data integrity and confidentiality. Successful exploitation could lead to full unauthorized access to encrypted data streams or the ability to forge session tokens, potentially resulting in complete system compromise and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade Apache OFBiz to version 24.09.06 or higher immediately to eliminate the hard-coded keys.

Proactive Monitoring: Monitor server logs for unusual decryption errors or patterns of unauthorized access requests originating from unexpected sources.

Compensating Controls: Implement strict network segmentation and restrict access to the OFBiz management interface to trusted IP addresses only until patching is completed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this cryptographic flaw, organizations must prioritize patching Apache OFBiz environments. Immediate remediation is required to prevent potential data breaches that could arise from the exposure of hard-coded credentials.