Cyber ·
CVE-2026-118196: OAuth 1 rebinding in Apache Allura, fixed in version 1.22.1
Security advisory on an OAuth 1 rebinding vulnerability in Apache Allura up to version 1.22.0, with a reported critical severity and a fix in version 1.22.1.
Advisory CVE-2026-118196 describes an OAuth 1 rebinding vulnerability in Apache Allura. According to the text received from the oss-sec feed, published by Dave Brondsema on 6 November, Apache Allura versions up to 1.22.0 are affected. The reported severity is critical. The advisory recommends updating to version 1.22.1, which fixes the problem. Credit for the finding goes to a reporter identified only by a handle, which we omit here.
The source does not detail the technical mechanism or indicate known exploitation, and we do not invent those details. For those who run an installation, the verifiable step is to confirm the version in use, apply 1.22.1 or later, and check the official CVE record and the project site to confirm the list of affected versions.
Relevance to Rota Nacional: Rota Nacional does not patch third-party software and does not solve this engineering problem. If your team uses AI to study the advisory or draft update scripts, do not paste credentials, tokens, API keys, production configurations or personal data into the prompt. The platform's automatic detection covers personal data types such as CPF, CNPJ, e-mail, phone and names, but it does not replace manually removing secrets. Remove them before sending.
Original source: CVE-2026-118196: vulnerabilidade de rebinding OAuth 1 no Apache Allura