Live Cloud Security Brief for August 4, 2026: IAM, Managed Services, and Exposure

CVE-2026-57510: SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService…

NIST National Vulnerability Database | July 29, 2026 | HIGH | CVSS 8.8

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas…

Why it matters: CVE-2026-57510 can involve both provider-managed software and tenant-owned identity or exposure settings. Those responsibilities must be separated before the finding can be closed.

What to verify: Check affected accounts and regions, public endpoints, identity paths, workload images, provider status, and centralized audit logs that prove the repaired control is active.

Operational focus: Confirm whether the provider has remediated the platform or whether tenant configuration remains exposed.

Open the original NIST National Vulnerability Database record

CVE-2026-16729: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

GitHub Advisory Database | August 4, 2026 | MEDIUM | CVSS 4.8 | GitHub Advisory Database undici

## Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `example.com; SameSite=None` lands verbatim as `Domain=example.com; SameSite=None`. The `unparsed` array's loop only checks each entry contains `=` and does not sanitize values, so an entry like `X-Custom=val; HttpOnly` lands unchanged, injecting `HttpOnly` without…

Why it matters: GitHub Advisory Database undici participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Review public endpoints, privileged identities, service accounts, and cross-account trust.

Open the original GitHub Advisory Database record

CVE-2026-18647: A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1.…

NIST National Vulnerability Database | August 4, 2026 | HIGH | CVSS 7.3

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for…