Live DevOps Security Brief for August 4, 2026: Pipelines, Dependencies, and Secrets

CVE-2026-69247: cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

GitHub Advisory Database | August 4, 2026 | HIGH | GitHub Advisory Database cryptography

### Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `RecipientInfo`'s `encryptedKey` in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied `EnvelopedData` and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key.…

Why it matters: GitHub Advisory Database cryptography participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Identify whether untrusted repository content can reach privileged runners, tokens, or deployment tools.

Open the original GitHub Advisory Database record

CVE-2026-69246: Guzzle: Noncanonical host can bypass host-based checks

GitHub Advisory Database | August 4, 2026 | HIGH | CVSS 7.2 | GitHub Advisory Database guzzlehttp/guzzle

### Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separately. The cURL handlers set `CURLOPT_URL` to the URI exactly as written and push that `Host` into `CURLOPT_HTTPHEADER`; `StreamHandler` does the same through `fopen()`. libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA…

Why it matters: GitHub Advisory Database guzzlehttp/guzzle participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Check dependency reachability and fixed versions before blocking or approving a release.

Open the original GitHub Advisory Database record

CVE-2026-69151: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

GitHub Advisory Database | August 3, 2026 | HIGH | GitHub Advisory Database @angular/compiler, @angular/core

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAttribute()` / `validateProperty()`), the i18n metadata collection path allowed these same attribute names to be marked for translation using `i18n-on*` attributes (e.g., `i18n-onerror`). When exploited, a lower-trust…

Why it matters: GitHub Advisory Database @angular/compiler, @angular/core participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.