CVEvulnerability

CVE-2026-55094

8.7 HIGH Published 2026-09-30 Modified 2026-09-30 Official page ↗
Status
Deferred
Published
2026-09-30
Last modified
2026-09-30
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-20, CWE-250, CWE-306, CWE-94, CWE-95

Description

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.

Related

Weakness · CWE (5)

  • CWE-20 Improper Input Validation weakness
  • CWE-250 Execution with Unnecessary Privileges weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References