Posted by theknell on Nov 09 Brian — Yours is the first reply that argues with the finding instead of the disclosure, so it gets an answer. "If you can access the config directory you already have everything" assumes the read happens on the live box. The precondition the paper states is a read of the config OR a backup, and backups do not live on the live box.
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/619
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Self-hosted Claude Managed Agents keeps agent credentials in your environment
Anthropic has released a self-hosted version of Claude Managed Agents. Companies can run the agent harness, sandboxes, credentials, and session history in their cloud or…
Dagster: Open-source cloud-native data pipeline orchestrator
Dagster is an open source orchestrator for data pipelines. It decides what runs, in what order, and when. It also tracks how the tables, datasets, machine learning…
"Malicious" public disclosure is a lot better than other ways of misusing 0-days (Was: [oss-security] Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-p
Posted by Aaron Rainbolt on Nov 09 I mean, if someone with knowledge of a 0-day decides to act maliciously, I'd much rather them do so by making said 0-day public than…
Re: [musl] Re: [oss-security] "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Rich Felker on Nov 09 I didn't see you'd also asked this on-list, so copying my answer here: This will possibly be changed (to always return null for failure)…
Re: “sshole”: password authentication bypass: OpenSSH + musl libc
Posted by Vidya Murthy on Nov 09 Adding a data point from the medical-device side: we reproduced this independently at Medcrypt, including on a stock Yocto image, no…
CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's secrets masker stopped descending into…