Dor Konis

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.37.1 Envoy versions prior to 1.36.5 Envoy versions prior to 1.35.8 Envoy versions prior to 1.34.13 **Description** Envoy is a high-performance edge/middle/service proxy. The Envoy RBAC (Role-Based Access Control) filter has a logic issue in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, obscuring the malicious value from exact-match mechanisms. The vulnerability affects the validation of headers used in RBAC policies. **Recommendations** Update to version 1.37.1. Update to version 1.36.5. Update to version 1.35.8. Update to version 1.34.13. Enable `rbac match headers individually`.

**Name of the Vulnerable Software and Affected Versions** datahub-helm versions 0.1.143 through 0.2.181 **Description** The issue is related to the use of a default cryptographic key in the helm chart for deploying Datahub in a Kubernetes cluster. If there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during the window of releases. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. **Recommendations** For versions 0.1.143 through 0.2.181, update to version 0.2.182 or later, which contains a patch for this issue. As a temporary workaround, reset the token signing key to be a random value, which will invalidate active personal access tokens. For deployments with Metadata Service Authentication enabled, ensure that secret values are properly randomized.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions up to and including 2.1.2 Apache Superset versions 3.0.0, 3.0.1 **Description** Uncontrolled resource consumption can be triggered by an authenticated attacker that uploads a malicious ZIP to import database, dashboards, or datasets. **Recommendations** For Apache Superset versions up to and including 2.1.2, update to a version later than 2.1.2 to resolve the issue. For Apache Superset versions 3.0.0 and 3.0.1, consider disabling the import functionality for database, dashboards, or datasets until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions up to and including 2.1.2 Apache Superset versions 3.0.0, 3.0.1 **Description** Uncontrolled resource consumption can be triggered by an authenticated attacker that uploads a malicious ZIP to import database, dashboards, or datasets. **Recommendations** For Apache Superset versions up to and including 2.1.2, update to a version later than 2.1.2 to resolve the issue. For Apache Superset versions 3.0.0 and 3.0.1, consider disabling the import functionality for databases, dashboards, or datasets until a patch is available. As a temporary workaround, restrict access to the import feature to minimize the risk of exploitation.