Security Digest: April 30, 2026 - 5 Critical Vulnerabilities
Today's security landscape is dominated by five critical vulnerabilities affecting several popular platforms. Immediate actions are necessary to mitigate risks.
· 4 min read
Executive Summary
Today's security landscape is dominated by five critical vulnerabilities affecting several popular platforms. Immediate actions are necessary to mitigate risks associated with server-side request forgery, identity collision, and account takeover threats.
Critical Vulnerabilities
- CVE-2026-40280: SSRF Bypass in Gotenberg
- Impact: Allows attackers to access internal network services, potentially exfiltrating sensitive data.
- Affected Systems: Gotenberg versions <= 8.30.1
- Immediate Action: Normalize URL schemes to lowercase or apply case-insensitive regex to deny-lists.
- Mitigation: Update deny-list patterns to be case-insensitive.
- CVE-2026-42560: Identity Collision in Patreon OAuth Provider
- Impact: Causes account merges, data leakage, and unauthorized access between different Patreon users.
- Affected Systems: Applications using github.com/go-pkgz/auth
- Immediate Action: Update the user ID derivation logic to use the correct Patreon ID.
- Mitigation: Apply patch as per the advisories or implement a manual fix.
- CVE-2026-42354: Account Takeover via SAML SSO in Sentry
- Impact: Enables attackers to hijack user accounts using a malicious SAML provider.
- Affected Systems: Multi-organization Sentry instances
- Immediate Action: Enable two-factor authentication for all users immediately.
- Mitigation: Upgrade to Sentry version 26.4.1 or higher.
- CVE-2026-39383: Unauthenticated SSRF via Webhook URL in Gotenberg
- Impact: Allows network probing and forced POST requests to internal services.
- Affected Systems: Gotenberg 8.29.1
- Immediate Action: Configure webhook URL deny-lists to block internal IP ranges.
- Mitigation: Update Gotenberg configurations as per security guidelines.
- CVE-2026-42449: SSRF via IPv6 in n8n-mcp
- Impact: Enables unauthorized requests to cloud metadata services.
- Affected Systems: n8n-mcp versions 2.47.4 to 2.47.13
- Immediate Action: Upgrade to version 2.47.14 immediately.
- Mitigation: Apply network egress restrictions and validate URLs.
Previously Alerted
What to Do Now
- Upgrade systems to the latest patched versions as detailed above.
- Implement immediate configuration changes where patches are not yet applied.
- Verify system logs for any signs of exploitation related to these vulnerabilities.
- Enable and enforce two-factor authentication across all relevant platforms.
- Monitor advisories for any additional updates or patches.