v2026.08.27
Ironclad/rivetv2026.08.27Aug 27, 2026by knu
Upgrading?
AI Summary
This critical security release addresses four vulnerabilities, including a command injection flaw, unauthorized OAuth binding, and duplicate event delivery. It also includes a migration to disconnect unauthorized private bindings.
Key Highlights
- Fixed command injection vulnerability in PdfInfoAgent event URLs.
- Resolved unauthorized binding of private OAuth Services to Agents.
- Fixed issue allowing manual triggering of event propagation across other users' Agents.
- Resolved duplicate event delivery during concurrent propagation scans.
- Introduced Service-binding migration to disconnect unauthorized private bindings.
Breaking Changes
- Unauthorized private Service bindings are disconnected, and affected Agents are disabled for administrator review.
Full Release Notes
This security release fixes four issues: - A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled. - An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential. - An authenticated user could manually trigger event propagation across other users' Agents. - Concurrent propagation scans could deliver the same event more than once. The command-injection issue affects installations where untrusted users can create and connect Agents. The two authorization issues affect multi-user installations. The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work. Operators should upgrade promptly. The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review. Full details: - https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842 - https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw - https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj - https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw **Full Changelog**: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27
Related Repositories
openclaw/openclaw★ 392,728
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
nilbuild/developer-roadmap★ 370,109
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
morluto/rea★ 361,667
Reverse engineer anything with agents, from app behavior down to native binaries.
anomalyco/opencode★ 219,934
The open source coding agent.
n8n-io/n8n★ 208,298
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.