Apache Airflow's SSH and SFTP connections skipped host key verification by default, so a worker would accept any server that answered. That hands a machine-in-the-middle the credentials and data of every task. This is CVE-2026-94134 and CVE-2026-94135, and the only warning was a line in a log.

Any registered Harbor user can create a project, and a project admin can point a webhook at any URL, including the cloud metadata endpoint. No validation, no admin needed. This is how a project webhook becomes a direct path to the registry's cloud IAM credentials.

Why this blog exists, and the two rules every post here follows.

You give a vision model an image by URL and the server fetches it for you. LMDeploy fetched any URL at all, including the cloud metadata endpoint, with no authentication required. CVE-2026-33626 was hit in the wild about twelve hours after the advisory went public.

Kyverno lets you write cluster policies that make HTTP calls. The call goes out from Kyverno's own pod, with Kyverno's network reach, not yours. CVE-2026-4789 turns a namespace-scoped policy into server-side request forgery against the whole cluster and the cloud metadata service. CVSS 9.8.

SGLang serves large language models. Two of its features opened a network socket that ran whatever Python object you mailed it, with no login. That is unauthenticated remote code execution, and it is the same copy-paste mistake half the AI serving world shipped. This is CVE-2026-3059 and its two siblings.

A race in the Linux kernel's in-kernel SMB3 server frees a per-channel signing key while another connection is still reading it. This is the story of CVE-2026-23226, from the leaked key to the kernel panic, and how it is the exact same class of bug the ksmbd maintainers had already patched once.