{"id":"EUVD-2026-81590","enisaUuid":"00907f28-d83b-3bc3-9ebf-02489e52a528","description":"vm2 versions 3.11.3 through 3.11.6 expose the host process\u0027s real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require(\u0027https\u0027). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent\u0027s \u0027free\u0027 event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host\u0027s Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.","datePublished":"Sep 17, 2026, 1:46:04 PM","dateUpdated":"Sep 17, 2026, 7:20:52 PM","baseScore":10.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-h85j-hv3c-qfgq\nhttps://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-https-credential-exposure-via-globalagent\n","aliases":"CVE-2026-92940\nGHSA-5843-9mh5-hhgw\nGHSA-h85j-hv3c-qfgq\n","assigner":"VulnCheck","epss":0.43,"enisaIdProduct":[{"id":"3ba48c04-61f1-397b-bdde-0c66cd516709","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"3.11.3 \u003c3.11.7"}],"enisaIdVendor":[{"id":"17cb1882-a47a-33b3-a994-ada5e4bcafd7","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"951c558b-7e35-327b-98c8-2fe33ac31f41","vulnerability":{"id":"GHSA-h85j-hv3c-qfgq","description":"vm2 exposes host HTTPS credentials and TLS traffic through globalAgent","datePublished":"Oct 1, 2026, 3:38:26 PM","dateUpdated":"Oct 1, 2026, 3:38:26 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-h85j-hv3c-qfgq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92940\nhttps://github.com/patriksimek/vm2/commit/aa146a77f859325e079f3bfbfe6d8309af483daa\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.7\nhttps://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-https-credential-exposure-via-globalagent\n","enisa_id":"EUVD-2026-81590\n","aliases":"GHSA-h85j-hv3c-qfgq\nCVE-2026-92940\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c25c3c1e-a0aa-30e3-8d35-bddc51de65cd","vulnerability":{"id":"GHSA-5843-9mh5-hhgw","description":"Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent","datePublished":"Sep 17, 2026, 3:32:14 PM","dateUpdated":"Oct 1, 2026, 3:38:02 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-h85j-hv3c-qfgq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92940\nhttps://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-https-credential-exposure-via-globalagent\n","enisa_id":"EUVD-2026-81590\n","aliases":"GHSA-5843-9mh5-hhgw\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"daae0432-f683-3190-aec3-941c5b31aa87","vulnerability":{"id":"CVE-2026-92940","description":"vm2 versions 3.11.3 through 3.11.6 expose the host process\u0027s real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require(\u0027https\u0027). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent\u0027s \u0027free\u0027 event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host\u0027s Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.","datePublished":"Sep 17, 2026, 1:46:04 PM","dateUpdated":"Sep 17, 2026, 7:20:52 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-h85j-hv3c-qfgq\nhttps://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-https-credential-exposure-via-globalagent\n","enisa_id":"EUVD-2026-81590\n","assigner":"VulnCheck","epss":0.43,"dataProcessed":"Nov 11, 2026, 7:25:41 AM","vulnerabilityProduct":[{"id":"12fcbe2d-9c35-3f21-a5a9-a2c4deb93e3d","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"3.11.3 \u003c3.11.7"}],"vulnerabilityVendor":[{"id":"e2d39cf6-4ad7-3523-98a0-f793c0f14e48","vendor":{"name":"patriksimek"}}]}}],"enisaIdAdvisory":[{"id":"06ceab9f-a3a3-3209-b4d4-fafb27208ddd","advisory":{"id":"RHSA-2026:80644","description":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Oct 12, 2026, 8:11:19 AM","dateUpdated":"Nov 7, 2026, 5:57:42 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:80644\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80644.json\n","aliases":"CVE-2026-47686\nCVE-2026-47698\nCVE-2026-84961\nCVE-2026-85152\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92960\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\nCVE-2026-101916\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"72ca4aa8-50b6-3673-8001-4b7805b5a019","product":{"name":"Red Hat Ansible Automation Platform 2.2","vendor":{"name":"Red Hat"}}},{"id":"8d3bba85-f3ae-3273-847b-179b70760554","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:cd22d7068dc9cdc475f4cb097b9019f54d5adf51927a3773c483040224018e96_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"1a3ff08d-252b-3e7e-a925-eee26da5b39a","advisory":{"id":"RHSA-2026:80603","description":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Oct 12, 2026, 5:44:41 AM","dateUpdated":"Nov 7, 2026, 5:57:42 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:80603\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80603.json\n","aliases":"CVE-2026-47686\nCVE-2026-47698\nCVE-2026-84961\nCVE-2026-85152\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92960\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\nCVE-2026-101916\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"345f9be6-2f62-3563-b654-79433799673a","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"d435b4ca-d802-3415-ba8a-e311b1155a03","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"211ea895-65b3-3960-8853-8a57f7ebd0ba","advisory":{"id":"RHSA-2026:79088","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 release.","summary":"Red Hat Developer Hub 1.10.5 has been released.","datePublished":"Oct 8, 2026, 7:56:41 AM","dateUpdated":"Nov 7, 2026, 2:47:06 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:79088\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79088.json\n","aliases":"CVE-2026-13697\nCVE-2026-14456\nCVE-2026-18798\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-55553\nCVE-2026-63072\nCVE-2026-63076\nCVE-2026-67213\nCVE-2026-67214\nCVE-2026-67422\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-77078\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84445\nCVE-2026-84961\nCVE-2026-87776\nCVE-2026-88932\nCVE-2026-89011\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"06cbcb1e-68b7-35e4-a7c7-453d95844710","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:f71a2783106a98ccbfb60f7219f8220cc778da946f0a800c2ce1d66384ed947a_amd64","vendor":{"name":"Red Hat"}}},{"id":"508477c2-1363-394b-bb5d-3facad96d5d0","product":{"name":"registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:2f71e0edb79f26d812edeb1754075159c9c9a0c8250c4d542e83a0725ad60725_amd64","vendor":{"name":"Red Hat"}}},{"id":"5636929f-17b0-3759-a7fe-08ca34a667d5","product":{"name":"registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:38374b57f1896ba7be54a5778ba55aa0e6766443c5421c6481a82f909cfacc51_amd64","vendor":{"name":"Red Hat"}}},{"id":"c2b0f25d-cb2e-34af-9e75-f837cebc386c","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:0f02ae0b8405912741a180af1c290feac2003e69d062bec9c7cd5d13f8732dc9_amd64","vendor":{"name":"Red Hat"}}},{"id":"cafb57df-e384-35d1-be1d-0e564954cb14","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:a20e789a899fcf4918db20426fce1d3d865391e7dee7c5c50e31533fbdd51fa0_amd64","vendor":{"name":"Red Hat"}}},{"id":"e910d332-380a-3bb6-bece-c3366490900c","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}}]}},{"id":"29e05b93-d572-331b-ae26-ec3213d1c517","advisory":{"id":"RHSA-2026:91651","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.10 release.","summary":"Red Hat Developer Hub 1.9.10 has been released.","datePublished":"Oct 28, 2026, 11:50:38 AM","dateUpdated":"Nov 11, 2026, 3:37:19 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:91651\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91651.json\n","aliases":"CVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-84445\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\nCVE-2026-111943\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"21fa6397-f7cf-3dcd-bfac-1b35c37b3cc2","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:b468b182954d3554b9b8934b65418233502ca24feb0ff66454c5f05e8055e35f_amd64","vendor":{"name":"Red Hat"}}},{"id":"ac6c8622-7e0c-3b6c-8cac-bf787eefa089","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:9dffcd643d4a9d3d5cea982ccec08cf50198920d9a08672c7b29994120d3e4fa_amd64","vendor":{"name":"Red Hat"}}},{"id":"d1d295ca-6505-31da-b8b3-5e30e16c3a0a","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:bbb5c34eb78780efa7168ae8d53a711a121174c5d7b4ec5f1a9187aba6f9e7ab_amd64","vendor":{"name":"Red Hat"}}},{"id":"f63c7ed2-2550-3b7b-b138-a121fa8b5b4f","product":{"name":"Red Hat Developer Hub 1.9","vendor":{"name":"Red Hat"}}}]}},{"id":"7c1562a6-e9bf-34e0-9c6e-09c356e12509","advisory":{"id":"RHSA-2026:82151","description":"Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.","datePublished":"Oct 13, 2026, 10:07:59 AM","dateUpdated":"Nov 10, 2026, 2:11:32 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:82151\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82151.json\n","aliases":"CVE-2026-13697\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-54284\nCVE-2026-55553\nCVE-2026-59893\nCVE-2026-71491\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84961\nCVE-2026-88932\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"2280b8dc-2fd5-30b0-8231-555177763c6b","product":{"name":"registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:8553c734145775879bdfe2befa9f2df1c22c6d7db2f2251401c3cc517a7e0394_amd64","vendor":{"name":"Red Hat"}}},{"id":"e47d596f-4737-3e57-a985-a89840767fcd","product":{"name":"Red Hat Ansible Automation Platform 2.2","vendor":{"name":"Red Hat"}}}]}},{"id":"a72264ac-a015-3626-b0d2-6aff1df9c62a","advisory":{"id":"RHSA-2026:76788","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","summary":"Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","datePublished":"Oct 6, 2026, 1:09:32 PM","dateUpdated":"Nov 7, 2026, 11:43:31 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:76788\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76788.json\n","aliases":"CVE-2026-13697\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-55553\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-77078\nCVE-2026-77413\nCVE-2026-77414\nCVE-2026-77415\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84961\nCVE-2026-87776\nCVE-2026-88932\nCVE-2026-89011\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"180d3269-d15f-343c-82e8-83cb197e3acc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:5549940696691cc087777c20f5d46b485d31e9fe3db896caa2eca7bfef3edb72_amd64","vendor":{"name":"Red Hat"}}},{"id":"49d020b5-3790-3915-8a55-d6e6d709f5f8","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}},{"id":"57ffb8cd-cfbe-3f7e-9c00-85aee590bf45","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:c6a5e6d9c8f3ab900c2b29848273540f4a3e97d351faa338a66da46c0b59d04f_amd64","vendor":{"name":"Red Hat"}}},{"id":"9fc9309a-ed78-376e-9e98-7d17f6b24ec7","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3aa39a8c3b7bf33aeaae5b3f924d0a2f7625e64657ce9b5517a3a73620f142bb_amd64","vendor":{"name":"Red Hat"}}},{"id":"b7170e41-a20c-34cb-af94-29802c6e7b5f","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:55b8b4e43f9dd474dee53d824591695012994daec86efee4dc08612b12425a46_amd64","vendor":{"name":"Red Hat"}}},{"id":"c0c3bef5-d9ee-3d1c-ae0d-0baec98a55b0","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:924c4e5e8642438f3099272ff7edd746a66fcec4779aeafb9fd6b3ae0c594f72_amd64","vendor":{"name":"Red Hat"}}},{"id":"e4e2cfac-97a6-3481-8285-5dfb16156229","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:df55fd567640bcd54d8e0d19baa97a5e72429865ad342c94bb80c3a49a5c184e_amd64","vendor":{"name":"Red Hat"}}},{"id":"feec8110-5ed4-3c49-8e16-23feb910d9bc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:0ca07bd2b15a85bfda16cbc0904fb4ee6c8620e18b891ba89ae792cf0a165095_amd64","vendor":{"name":"Red Hat"}}}]}}]}