Posted by Goutham Pacha Ravi on Oct 07 OSSN-0109: Cross-project metric association bypass in Gnocchi (2026-10-07) Summary The Gnocchi metric creation endpoint allows authenticated users to associate metrics with resources owned by others by passing resource_id in the request body bypassing proper authorization checks.
[OSSN-0109] Cross-project metric association bypass in Gnocchi
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/91
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Vincent Lefevre on Nov 05 Perhaps, but in any case, it is up to the application to check error conditions, in particular that the result contains only valid…
Fwd: Go 1.27.4 and Go 1.26.11 pre-announcement
Posted by Alan Coopersmith on Nov 05 Forwarded Message Subject: [security] Go 1.27.4 and Go 1.26.11 pre-announcement Date: Thu, 5 Nov 2026 22:10:14 +0000 From: announce…
Re: CPython sandbox escape
Posted by Sam James on Nov 05 Alan Coopersmith writes: https://lwn.net/Articles/574215/ sam
zlib 1.4 released with security fixes
Posted by Alan Coopersmith on Nov 05 https://github.com/madler/zlib/releases/tag/v1.4 lists these security fixes:
Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Loganaden Velvindron on Nov 05 It's unfortunate that some people are writing misleading statements about a security problem in OpenSSH, especially on linkedin…
CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3.0.4 Description: Inconsistent interpretation of HTTP requests ('HTTP…