By weakness (CWE)

CWE-636: related vulnerabilities

CVEs classified under CWE-636. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

7 published vulnerabilities

• CVE-2026-54762HIGH 8.6

  Traefik, a widely-used reverse proxy and load balancer, has a flaw in how it handles Kubernetes authentication configuration. When an operator sets up BasicAuth or DigestAuth protection on a route via Kubernetes annotations but the system cannot find or read the required authentication credential (the Secret), Traefik logs the error and then publishes the route anyway—without the authentication protection. This means unauthenticated users can access backends that operators believed were protected. The flaw affects versions 3.7.0-ea.1 through 3.7.4 and is corrected in 3.7.5.

• CVE-2026-54291MEDIUM 5.9

  pgjdbc, the official PostgreSQL JDBC driver, contains a flaw in versions 42.7.4 through 42.7.11 where connections explicitly configured to require channel binding security (channelBinding=require) can be silently downgraded to a weaker authentication method. An attacker positioned to intercept TLS traffic can force this downgrade by presenting a certificate with an unsupported signature algorithm, causing the driver to drop the man-in-the-middle protection that channel binding provides. The vulnerability stems from incomplete validation: the driver checks only that the server advertises a secure mechanism but fails to reject empty or missing channel-binding data. Version 42.7.12 and later fix this issue.

• CVE-2026-55568MEDIUM 5.9

  Guzzle, a widely-used PHP HTTP client library, contains a flaw that causes proxy credentials and encrypted connection metadata to be transmitted unencrypted under specific conditions. When an application configures an HTTPS proxy expecting end-to-end encryption to that proxy, older versions of the underlying libcurl library (prior to 7.50.2) silently downgrade the connection to plain HTTP instead of raising an error. This means proxy usernames, passwords, and the details of HTTPS requests being tunneled through the proxy are exposed in cleartext on the network. The vulnerability only affects applications using Guzzle's built-in cURL handlers (the default) with https:// proxy configurations and outdated libcurl versions.

• CVE-2026-53852MEDIUM 5.4

  OpenClaw versions before 2026.4.25 contain a flaw that allows authenticated operators to bypass access control restrictions when re-pairing devices. By submitting re-pairing requests with empty scope parameters, an attacker can trick the system into granting broader device access than should be permitted. This is a privilege-escalation vulnerability affecting users who already have some level of access to the system.

• CVE-2026-53837LOW 3.7

  OpenClaw versions before 2026.5.6 contain a flaw in how they handle Mattermost event processing that allows attackers to bypass direct message (DM) policy restrictions. The vulnerability exists because the application fails to properly check channel type metadata when processing incoming events. An attacker can craft malicious Mattermost events that omit channel type information, causing the application to incorrectly process content that should have been restricted. While the potential impact is limited, this represents an integrity issue that could allow policy circumvention.

• CVE-2026-49317LOW 2.4

  The 2025 Indian Motorcycle Scout Bobber + Tech infotainment system has a logic flaw in how it initializes during boot. The system is supposed to require a PIN to unlock, but it uses a problematic shortcut: it checks whether it detects wireless messages from the motorcycle's Wireless Control Module (WCM) during startup. If those messages are absent, the system assumes no immobilizer is present and skips the PIN screen entirely, granting immediate access to the infotainment interface. An attacker with adjacent network access can silence the WCM during the boot window—using techniques like a CAN bus-off attack—to trick the system into thinking the immobilizer is not installed, thereby bypassing the PIN protection that should guard the interface.

• CVE-2026-49318LOW 2.4

  A flaw in the 2025 Indian Motorcycle Scout Bobber + Tech's infotainment system allows someone with physical proximity to the motorcycle to unlock the digital display without entering the correct PIN. The system incorrectly assumes that if it doesn't detect wireless signals from a control module during startup, no security PIN is needed. An attacker can exploit this by blocking those signals during the boot process, causing the system to skip the PIN screen entirely and display the full user interface.