CVE-2026-55094Published
Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-55094 · Microsoft / collected KEV context
cve-program · CVE-2026-55094
- https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38
- https://github.com/taskcluster/taskcluster/issues/8716
- https://github.com/taskcluster/taskcluster/pull/8718
- https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b
- https://bugzilla.mozilla.org/show_bug.cgi?id=2045091
- https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.