At A Glance
- 398 new network-exploitable CVEs published August 28–September 3, 2026
- 67 cleared our severity bar (CVSS 8.6+), including 5 rated a perfect 10.0
- Featured vulnerability: CVE-2026-85154, a non-expiring, non-revocable admin bearer token in WWBN AVideo
- Three separate products (Langflow, hulumi, and Craft CMS) each shipped three distinct identity or authorization failures on a single disclosure day
- The common thread, again: the credential or connection worked exactly as it was designed to. The design was the problem.
Most weeks in this series come down to a service that should never have been reachable at all: an admin console with no login screen, an API bound to every interface by default. This week had plenty of that. But it also had something more instructive: vendors whose authentication existed on paper, ran on schedule, and still failed, because nobody asked how long a valid credential should actually stay valid.
That question sits at the center of this edition’s featured flaw, and it shows up again in three of this week’s most interesting disclosures. Langflow, hulumi, and Craft CMS each shipped a trio of separate identity-boundary failures in a single day. Three different ways the same product got authorization wrong, all found and fixed at once.
Vulnerabilities By The Numbers
For August 28–September 3, 2026, 398 new network-exploitable CVEs were published. 67 cleared our severity bar (CVSS 8.6+), including 5 rated a perfect 10.0. A few worth knowing about:
- CVE-2026-82456 (10.0, CRITICAL): argocd-mcp binds its HTTP transport to every network interface and accepts MCP sessions without caller credentials whenever an API token is configured on the server side. MCP is the protocol AI agents use to reach tools like Argo CD. This is the third edition running where “AI agent infrastructure” and “reachable by default” have shown up in the same sentence.
- Three separate RCE paths in IBM Langflow OSS (CVE-2026-19295, 9.9; CVE-2026-19286, 9.8; CVE-2026-18729, 8.8): a crafted flow type field, an unrestricted A2A public endpoint, and improper control of code generation, all disclosed the same day, all in the same AI workflow platform.
- Three IAM/cloud-boundary bypasses in hulumi and @hulumi/policies (CVE-2026-82857, CVE-2026-82856, CVE-2026-82859, all 9.8, CRITICAL): a weekly integration policy, a GitHub OIDC trust condition, and a deployment SCP template all quietly widened the same boundary they were supposed to hold.
- Three authorization failures in Craft CMS (CVE-2026-84795, CVE-2026-84796, CVE-2026-84801, 9.8/8.8/8.8): a deactivated admin’s status persisting through re-registration, a GraphQL resolver that skipped site-scope checks, and an endpoint that would mint a password-reset URL for any administrator on request.
Every one of these CVEs represents a product that thought it already answered “is this request allowed?” appropriately. Spoiler alert: It didn’t.
No Expiration Ever: This Edition’s Most Dangerous Vulnerability
The standout is CVE-2026-85154, an authentication-failure vulnerability in WWBN AVideo. The platform issues a video_id_hash credential that functions as a bearer token for full administrator session access to the video owner’s account, and that token never expires and can never be revoked. Once it exists, it works indefinitely, and can end up somewhere it shouldn’t, like a shared link, a log line, or a stray screenshot. Whoever holds it has standing administrative access, with no clock running out and no button to shut it off.
It’s not the only identity primitive AVideo got wrong this week. A second flaw (CVE-2026-84480, 9.8) let a password-recovery token be replayed indefinitely because nobody checked whether it had expired, and a third (CVE-2026-84482, 8.8) forged requests across sibling subdomains by trusting the wrong signal for “same origin.” Three CVEs, one product, one week: every one of them is a credential or a trust decision that was supposed to have a boundary and didn’t.
Strip away the video-hosting specifics and this vulnerability takes a familiar shape: authentication that exists, and access that lasts far longer than it should have.
How Identity-First Reachability Closes This Gap
Identity-First Reachability doesn’t treat a token as a permanent stand-in for identity. Every connection, every time, requires an actively verified identity and an explicit policy decision before a service becomes reachable. There’s no bearer credential sitting in the middle that, once copied, keeps working indefinitely on its own.
If the AVideo admin surface had been sitting behind NetFoundry’s Identity-First Reachability, a leaked video_id_hash would have bought an attacker nothing. The service itself would never have been network-visible to a request that hadn’t just been authenticated and authorized to make it, no matter how long ago the underlying token was issued or who ended up holding a copy.
Don’t Be the Next Reachability Watch Headline
If there’s one takeaway from this edition, it’s that “we have authentication” and “we enforce authentication, continuously, at connection time” are different claims. 398 new CVEs in a week is more than any team patches its way through, and this week’s pattern makes the point for us. The weakness usually isn’t a missing check; it’s a check run only once, at login, that, once cleared, trusts whatever it’s handed for however long that credential survives.
See how NetFoundry’s Identity-First Reachability makes your services invisible to attackers before this year’s CVE becomes next year’s KEV.
Frequently Asked Questions
What is MCP, and why does it keep showing up in this tracker?
MCP (Model Context Protocol) is how AI agents connect to external tools and data sources. It’s the same job an API used to do, just with an agent instead of a person on the other end of the request. It keeps showing up here because MCP servers are getting shipped with the same reachable-by-default assumptions as the admin consoles that came before them, just with a newer name and a faster deployment pace.
Why do three unrelated bugs keep showing up in the same product on the same day?
Because they usually aren’t unrelated. They’re the same design gap, discovered from three different angles during one security review or one disclosure cycle. When a product treats identity or authorization as an afterthought in one place, it’s rarely an afterthought in only one place.
What makes a non-expiring bearer token worse than a stolen password?
A password can be rotated, and most systems lock an account out after enough failed attempts. A bearer token that never expires and can’t be revoked keeps working for as long as it exists, with no equivalent circuit breaker. Whoever holds a copy has standing access until the underlying code changes.
Why does NetFoundry use a CVSS 8.6+ floor instead of tracking every published CVE?
Volume. Hundreds of CVEs publish every week, and most never get exploited in practice. CVSS 8.6+ isolates the ones that combine real severity with network exploitability: the flaws where “an attacker could reach this” is the only precondition left standing.
How does Identity-First Reachability prevent this class of attack?
Identity-First Reachability is a security model where every connection requires a verified identity and an explicit policy before a service becomes visible on the network at all, rather than relying on a credential that, once issued, is trusted indefinitely. At NetFoundry, this means a vulnerable service is never reachable by a requester who hasn’t just been authenticated and authorized to reach it, regardless of how old their token is or whether a patch exists yet.
