Technical articles, research notes and CVE write-ups from the rootzero team: offensive security, detection, method.https://rootzero.eu/en-GBhttps://rootzero.eu/en/research/ai-red-team-rules-of-work/https://rootzero.eu/en/research/ai-red-team-rules-of-work/Let AI understand the target, keep facts separate from hypotheses, and grant autonomy according to the real cost of a wrong action.Tue, 20 Oct 2026 00:00:00 GMTBlogAIRed TeamMethodologycontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/build-a-useful-mcp-server-for-a-tool/https://rootzero.eu/en/research/build-a-useful-mcp-server-for-a-tool/An MCP server earns its keep when tools have precise actions, bounded outputs and real authorization. A practical method using a fictional read-only catalogue.Tue, 20 Oct 2026 00:00:00 GMTBlogAIMCPMethodologycontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cli-obfuscation-effects-signatures/https://rootzero.eu/en/research/cli-obfuscation-effects-signatures/Two command lines can produce the same output but leave different text in telemetry. A small lab method for testing CLI rules without claiming an EDR bypass.Tue, 20 Oct 2026 00:00:00 GMTBlogRed TeamDetectionLinuxCLIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/init-bin-bash-root-linux-boot/https://rootzero.eu/en/research/init-bin-bash-root-linux-boot/A boot parameter can launch Bash as PID 1 and give root, under specific conditions. An owned-VM exercise and the limits of GRUB, encryption, and Secure Boot.Tue, 20 Oct 2026 00:00:00 GMTBlogLinuxPhysical accessHardeningBootcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/vpn-kill-switch-prove-no-ip-leak/https://rootzero.eu/en/research/vpn-kill-switch-prove-no-ip-leak/A VPN route does not guarantee that your source IP stays hidden. Define a fail-closed policy and test DNS, IPv6 and reconnects against your own endpoint.Tue, 20 Oct 2026 00:00:00 GMTBlogRed TeamVPNNetworkOpSeccontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/wpsplinter-france-paris-survey/https://rootzero.eu/en/research/wpsplinter-france-paris-survey/Quentin Kaiser proved WPSplinter on Belgian gateways. His Paris radio survey flags French models, without measuring national exposure or proving RCE on them.Tue, 20 Oct 2026 00:00:00 GMTBlogWi-FiVulnerabilitiesFranceResearchcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/forgotten-attack-surface/https://rootzero.eu/en/research/forgotten-attack-surface/Certificate Transparency, forgotten staging servers, open cloud storage, typosquats, SPF/DKIM/DMARC: what an attacker sees of you before you do.Wed, 14 Oct 2026 00:00:00 GMTBlogExposureNetworkWebGovernancecontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/offensive-agents-scope-guardrails/https://rootzero.eu/en/research/offensive-agents-scope-guardrails/An autonomous testing agent that sends requests to real systems must stay within the authorised scope, including when the model driving it makes a mistake or is manipulated by the target’s content. This note describes an architecture in which guardrails are enforced outside the model, on every request: declarative scope, address resolution and pinning, redirect revalidation, rate limiting, graded action classes, lease-based kill switch, hash-chained audit log and the human role. It lists the known pitfalls and the limits of the approach.Thu, 08 Oct 2026 00:00:00 GMTResearchMethodologyPentestAIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cvss-is-not-risk/https://rootzero.eu/en/research/cvss-is-not-risk/CVSS measures technical severity and ignores your context. CVSS 3.1 and 4.0, EPSS, the CISA KEV catalogue: how to prioritise with data.Thu, 01 Oct 2026 00:00:00 GMTBlogVulnerabilitiesGovernanceDetectioncontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/jwt-five-mistakes/https://rootzero.eu/en/research/jwt-five-mistakes/alg none, algorithm confusion, weak HMAC secrets, kid injection, tokens that never expire: five classic JWT mistakes and how to fix them.Thu, 17 Sep 2026 00:00:00 GMTBlogWebAPIAuthenticationcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-33625-lmdeploy-eval-rce/https://rootzero.eu/en/research/cve/cve-2026-33625-lmdeploy-eval-rce/LMDeploy built a Python expression from the quant_dtype field of a model’s quantization_config and passed it to eval() while loading the model configuration. Anyone able to publish a model that an operator later loads, on Hugging Face Hub or any other repository, could run arbitrary code on the inference host with the privileges of the LMDeploy process. Fixed in 0.12.3.Wed, 16 Sep 2026 00:00:00 GMTCVECVE-2026-33625Code injectionCode executionAI and machine learningPyPIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-85575-shopengine-stored-xss/https://rootzero.eu/en/research/cve/cve-2026-85575-shopengine-stored-xss/The Product Title widget printed shopengine_product_title_header_size without an allowlist. Our ShopEngine 4.8.9 test proves storage by an Author and execution in a visitor browser; Wordfence describes Contributor+ scope. Fixed in ShopEngine 4.9.6.Tue, 15 Sep 2026 00:00:00 GMTCVECVE-2026-85575XSSWordPressPHPcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/proof-before-alert/https://rootzero.eu/en/research/proof-before-alert/Penetration test reports often mix demonstrated findings with inferences: versions assumed to be vulnerable, recognised signatures, ambiguous responses. This note defines what a demonstrated finding is and proposes a five-step chain (hypothesis, attempt, observed response, independent verification, replayable re-test), illustrated by the detection of a server-side template injection. It lists the main classes of false positives and the limits of the approach.Thu, 10 Sep 2026 00:00:00 GMTResearchMethodologyPentestVulnerabilitiescontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-68896-windows-search-eop/https://rootzero.eu/en/research/cve/cve-2026-68896-windows-search-eop/We followed a per-user Search catalogue from a user-writable profile into SYSTEM cleanup at logon. A non-admin test deleted a protected file that the same user could not delete; a fresh-install control reproduced that primitive. The later code-execution conversion had extra Windows Installer and lab-orchestration conditions. Microsoft fixed CVE-2026-68896 in September 2026.Tue, 08 Sep 2026 00:00:00 GMTCVECVE-2026-68896Path traversalPrivilege escalationWindowscontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-81963-windows-update-stack-eop/https://rootzero.eu/en/research/cve/cve-2026-81963-windows-update-stack-eop/We revisited the narrow fix for CVE-2020-0728, discarded a promising but unproven CBS path, and found a caller-controlled package sandbox that TrustedInstaller reused without impersonation. Separate lab controls established a privileged write and then SYSTEM execution. Microsoft fixed CVE-2026-81963 in September 2026; the original route stopped on build 26200.9445.Tue, 08 Sep 2026 00:00:00 GMTCVECVE-2026-81963Link followingPrivilege escalationWindowscontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/reverse-shells-detect-and-block/https://rootzero.eu/en/research/reverse-shells-detect-and-block/Why a reverse shell passes permissive egress filtering, and how to spot one: egress filtering, process lineage, Sysmon, auditd and EDR.Thu, 03 Sep 2026 00:00:00 GMTBlogDetectionNetworkSystemscontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/wordpress-elementor-addons-stored-xss-tag-names/https://rootzero.eu/en/research/cve/wordpress-elementor-addons-stored-xss-tag-names/Six WordPress plugins let a user with the Contributor role choose the HTML tag of a heading or wrapper, then printed that value with esc_attr() or with no escaping at all. A value such as img src=x onerror=alert(1) contains no angle bracket, passes kses untouched and becomes a working element with an event handler once the plugin writes it after a less-than sign. The result is stored XSS in pages that editors, administrators and visitors open. Each plugin has a fixed release.Fri, 07 Aug 2026 00:00:00 GMTCVECVE-2026-6504CVE-2026-8677CVE-2026-8613CVE-2026-8607CVE-2026-11390CVE-2026-18988XSSVariant analysisWordPressPHPcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-84191-librenms-stored-xss-snmp/https://rootzero.eu/en/research/cve/cve-2026-84191-librenms-stored-xss-snmp/LibreNMS stored the VRF name, description and route distinguisher returned by monitored devices over SNMP, then echoed them into its routing pages without HTML escaping. A device under the attacker’s control, or anyone able to tamper with SNMPv1/v2c traffic, could plant JavaScript that runs in the browser of every user who opens those pages. Main rendering sinks fixed in 26.5.0; a separate onmouseover sink was changed in 26.8.0.Tue, 04 Aug 2026 00:00:00 GMTCVECVE-2026-84191XSSMonitoring and CTIPHPcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-34398-34399-freecad-bim-eval-rce/https://rootzero.eu/en/research/cve/cve-2026-34398-34399-freecad-bim-eval-rce/The BIM workbench of FreeCAD passed values read from files to Python eval(): four working plane fields from the metadata of a .FCStd template in the Project Manager, and the Scale field of an SVG template when creating a TechDraw page. A user who loads a crafted template runs the attacker’s Python code with their own privileges. Both flaws are fixed in FreeCAD 1.1.1.Thu, 23 Jul 2026 00:00:00 GMTCVECVE-2026-34398CVE-2026-34399Code injectionCode executionDesktop softwareC++contact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-77262-mcp-atlassian-arbitrary-file-read/https://rootzero.eu/en/research/cve/cve-2026-77262-mcp-atlassian-arbitrary-file-read/The confluence_upload_attachment tool of MCP Atlassian passed its file_path argument to open() with no path check, then uploaded the bytes to Confluence. A caller with access to that tool could upload any file readable by the server process to a writable Confluence destination. An HTTP client needs an HTTP deployment; an agent route additionally depends on the agent following hostile content, which the file-read proof did not test. The earlier fix for GHSA-xjgw-4wvw-rgm4 guarded the download direction only. Fixed in 0.22.0.Fri, 10 Jul 2026 00:00:00 GMTCVECVE-2026-77262File readIncomplete fixMCP serversAI and machine learningPyPIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-34049-coolify-backup-command-injection/https://rootzero.eu/en/research/cve/cve-2026-34049-coolify-backup-command-injection/Coolify’s fix for CVE-2025-66209 validated and escaped the database names of a backup configuration, but the MongoDB collection names written in the same field still went into the mongodump command unescaped. A team member able to configure backups, which the default policy allows for everyone, could run commands as root on the managed server. The vendor scores it 3.3; the technical impact is close to the original 9.9 flaw. Fixed in 4.0.0-beta.471.Thu, 02 Jul 2026 00:00:00 GMTCVECVE-2026-34049Command injectionIncomplete fixDevOps and PaaSPHPcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-35211-opencti-painless-script-injection/https://rootzero.eu/en/research/cve/cve-2026-35211-opencti-painless-script-injection/The GraphQL API of OpenCTI exposed a script value in its FilterOperator enum, and the query builder copied the filter value into an Elasticsearch script query without any check. Any authenticated user with the KNOWLEDGE capability could make the search cluster execute arbitrary Painless code on every candidate document, enough to exhaust its CPU and degrade the platform for all users. Fixed in 7.260401.0, where the operator is refused unless an explicit setting enables it.Wed, 01 Jul 2026 00:00:00 GMTCVECVE-2026-35211Code injectionQuery injection (Cypher, KQL, Painless)Monitoring and CTInpmcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/ghsa-wg9g-w2j2-8pgr-monai-numpy-pickle-rce/https://rootzero.eu/en/research/cve/ghsa-wg9g-w2j2-8pgr-monai-numpy-pickle-rce/The NumpyReader class of MONAI called np.load() with allow_pickle=True hard-coded, and LoadImage selects that reader for every .npy and .npz file. A crafted file placed in a dataset therefore executed arbitrary code, through pickle’s __reduce__ protocol, in the process of whoever loaded it for training or inference. Users could not turn the option off. Fixed in 1.6.0, where pickle loading is disabled by default.Thu, 11 Jun 2026 00:00:00 GMTCVEGHSA-wg9g-w2j2-8pgrDeserialisationCode executionAI and machine learningPyPIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-48017-dbgate-rce/https://rootzero.eu/en/research/cve/cve-2026-48017-dbgate-rce/The POST /runners/load-reader endpoint of DbGate copied a functionName parameter into JavaScript source that the server then ran in a forked process. Any logged-in user, with no particular permission, could close the expected call, append code and reach the operating system through process.binding("spawn_sync"), which the require = null sandbox leaves available. Fixed in 7.1.9.Fri, 22 May 2026 00:00:00 GMTCVECVE-2026-48017Code executionCode injectionData platformsnpmcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-45662-dokploy-command-injection/https://rootzero.eu/en/research/cve/cve-2026-45662-dokploy-command-injection/When a registry was deleted, self-hosted Dokploy ran docker logout with the stored registry URL concatenated into a shell command, although the same file escaped that value for docker login. A user allowed to create and delete registries could store a URL containing shell metacharacters and run commands on the Dokploy host, which drives Docker and holds the platform’s secrets. Fixed in 0.29.3.Mon, 11 May 2026 00:00:00 GMTCVECVE-2026-45662Command injectionCode executionDevOps and PaaSnpmcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-40864-jupyterhub-xsrf-bypass/https://rootzero.eu/en/research/cve/cve-2026-40864-jupyterhub-xsrf-bypass/From 4.1.0, JupyterHub used the Sec-Fetch-Mode header to decide whether a cookie-authenticated request needed an XSRF token, and exempted every no-cors request whatever its method or origin. A page on another origin could send credentialed form-encoded POSTs to /hub/spawn or /hub/accept-share, starting the victim’s server or making the victim accept a share of the attacker’s server. Fixed in 5.4.5.Tue, 05 May 2026 00:00:00 GMTCVECVE-2026-40864CSRFData platformsPyPIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-41490-dagster-sql-injection/https://rootzero.eu/en/research/cve/cve-2026-41490-dagster-sql-injection/Five Dagster database I/O managers built the WHERE clause of their SELECT and DELETE statements by pasting partition keys between single quotes. With a DynamicPartitionsDefinition, those keys are created at runtime through the GraphQL API, so anyone allowed to add a partition and launch a run could execute SQL against the warehouse with the I/O manager’s credentials. Fixed in dagster 1.13.1 and integrations 0.29.1.Fri, 17 Apr 2026 00:00:00 GMTCVECVE-2026-41490SQL injectionVariant analysisData platformsPyPIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-33715-chamilo-ssrf-open-relay/https://rootzero.eu/en/research/cve/cve-2026-33715-chamilo-ssrf-open-relay/The installation wizard endpoint public/main/inc/ajax/install.ajax.php stayed reachable on installed Chamilo LMS 2.0 instances, with no session and no installation check. Its test_mailer action handed a DSN taken from the request to Symfony Mailer, so an unauthenticated attacker could make the server connect to any SMTP host and port and send a message to any address. Fixed in 2.0-RC.3.Tue, 14 Apr 2026 00:00:00 GMTCVECVE-2026-33715SSRFMissing authenticationEmailE-learningPHPcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-34160-chamilo-pens-ssrf/https://rootzero.eu/en/research/cve/cve-2026-34160-chamilo-pens-ssrf/The PENS plugin endpoint public/plugin/Pens/pens.php of Chamilo LMS 2.0 required no session and took its package-url, receipt and alerts URLs from the request. The URL checks only looked at the scheme and the presence of a host, so an unauthenticated attacker could make the server send GET and POST requests to internal hosts and to the cloud metadata service. Fixed in 2.0-RC.3.Tue, 14 Apr 2026 00:00:00 GMTCVECVE-2026-34160SSRFMissing authenticationVariant analysisE-learningPHPcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/pfsense-sa-26-03-diag-arp-stored-xss/https://rootzero.eu/en/research/cve/pfsense-sa-26-03-diag-arp-stored-xss/With ISC DHCP enabled, pfSense printed a client-supplied lease hostname into diag_arp.php without HTML encoding. A DHCP client on that local network could plant JavaScript that ran when an administrator opened the ARP table. Netgate lists Plus 26.03.1 and 26.07, CE 2.9.0 and recommended System Patches as fixed paths; Kea was not affected.Wed, 01 Apr 2026 00:00:00 GMTCVEpfSense-SA-26_03.webguiXSSMonitoring and CTIPHPcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-34940-kubeai-command-injection/https://rootzero.eu/en/research/cve/cve-2026-34940-kubeai-command-injection/KubeAI built the startup probe of Ollama model pods by formatting the Model URL into a bash -c script. Anyone allowed to create or update Model resources, a right often delegated to tenants who are not cluster administrators, could append shell commands to the URL and have the kubelet run them inside the model pod, next to its secrets and service account token. Fixed in 0.23.2.Tue, 31 Mar 2026 00:00:00 GMTCVECVE-2026-34940Command injectionCode executionDevOps and PaaSAI and machine learningGocontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-34975-plunk-email-header-injection/https://rootzero.eu/en/research/cve/cve-2026-34975-plunk-email-header-injection/Plunk built the raw MIME message it hands to Amazon SES by interpolating from.name, subject, custom header keys and values, and attachment filenames into a template string. None of these fields rejected line breaks, so any holder of a project API key could add header fields of their choice or reshape MIME parts in the emails sent through POST /v1/send. Fixed in 0.8.0 by schema validation.Tue, 31 Mar 2026 00:00:00 GMTCVECVE-2026-34975CRLF injectionEmailnpmcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-33980-adx-mcp-server-kql-injection/https://rootzero.eu/en/research/cve/cve-2026-33980-adx-mcp-server-kql-injection/The get_table_schema, sample_table_data and get_table_details tools of adx-mcp-server built Kusto queries by inserting the table_name argument into f-strings. Any MCP client, including an agent steered by prompt injection, could turn a call to these metadata tools into an arbitrary KQL query or management command, outside the approval policy applied to execute_query. Fixed in commit 0abe0ee; no release on PyPI contains it yet.Wed, 25 Mar 2026 00:00:00 GMTCVECVE-2026-33980Query injection (Cypher, KQL, Painless)MCP serversAI and machine learningData platformsPyPIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/cve/cve-2026-32247-graphiti-cypher-injection/https://rootzero.eu/en/research/cve/cve-2026-32247-graphiti-cypher-injection/Before 0.28.2, graphiti-core joined the node_labels of a SearchFilters object with | and concatenated the result into the WHERE clause of its Neo4j, FalkorDB and Neptune queries. A caller who could choose those labels could alter the query and bypass its group_id filter. Read access across groups follows from the query construction; write clauses also depend on the backend route and database permissions. A prompt-injection route through an agent is possible but was not demonstrated by the query proof. Fixed in 0.28.2.Wed, 11 Mar 2026 00:00:00 GMTCVECVE-2026-32247Query injection (Cypher, KQL, Painless)MCP serversAI and machine learningPyPIcontact@rootzero.eu (rootzero)