Daily Threat Briefing
← All briefings

StackGres Kubernetes Operator · exceljs · justhtml

Date: 2026-08-24 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Today’s most notable new items are a privilege escalation flaw in StackGres (CVSS 9.9) allowing database tenants to gain cluster admin rights, a cluster of vulnerabilities in the exceljs library including prototype pollution and path traversal, and multiple critical flaws in the justhtml Python library. The UK government has confirmed a cyberattack that shut down a power station for four days — a significant critical infrastructure incident. The CVE-2026-73570 Zimbra KEV deadline expires today; immediate action is required.

Critical Vulnerabilities

CVE-2026-78155 — StackGres Kubernetes Operator (Privilege Escalation)

  • Severity: CVSS 9.9
  • EPSS: 0.0 — newly published
  • Technical detail: A privilege escalation flaw in the StackGres Kubernetes operator (versions ≤ 1.18.8) allows a low-privilege tenant with database access to gain full cluster administrator privileges. In multi-tenant Kubernetes environments, this represents a complete trust boundary violation — a compromised or malicious database user can pivot to control the entire cluster, access secrets, and affect co-hosted workloads. The attack requires only a valid low-privilege database account.
  • Exploitation status: No confirmed exploitation; CVSS 9.9 in a Kubernetes operator warrants urgent treatment.
  • Remediation: Upgrade StackGres to ≥ 1.18.9. Audit Kubernetes RBAC bindings associated with StackGres service accounts. Review tenant isolation controls and restrict database user permissions to least privilege.

CVE-2026-78207 / CVE-2026-78208 / CVE-2026-78206 / CVE-2026-78209 — exceljs (Multiple Flaws)

  • Severity: CVSS 9.3 (CVE-2026-78207), 8.7 (CVE-2026-78208, CVE-2026-78206), 8.4 (CVE-2026-78209)
  • EPSS: 0.0 — newly published
  • Technical detail: Four CVEs affect exceljs (the widely used Node.js Excel library) in versions ≤ 4.4.0, addressed in exceljs-hardened 5.0.0. CVE-2026-78207 is the most critical: a prototype pollution vulnerability in the deepMerge helper fails to reject __proto__, constructor, or prototype keys when merging note objects, potentially enabling RCE or application logic corruption. CVE-2026-78208 allows arbitrary file reads via unsanitized paths in Workbook.addImage(). CVE-2026-78206 is a zip bomb / decompression bomb via unbounded XLSX archive extraction. CVE-2026-78209 enables CSV formula injection via unescaped cell values. These affect any Node.js application that processes user-supplied Excel or CSV files — common in enterprise data import workflows, finance tools, and reporting pipelines.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Migrate to exceljs-hardened ≥ 5.0.0 or apply equivalent patches. Validate all user-supplied file paths and archive inputs server-side. Enforce file size and decompression limits at the application layer.

CVE-2026-7808 / CVE-2026-5388 / CVE-2026-8445 / CVE-2026-9769 / CVE-2026-4671 — justhtml (Multiple Security Flaws)

  • Severity: CVSS 9.3 (CVE-2026-7808, CVE-2026-5388, CVE-2026-8445), 8.7 (CVE-2026-9769, CVE-2026-4671)
  • EPSS: 0.0 — newly published
  • Technical detail: Five CVEs span the justhtml Python HTML parsing and sanitization library across multiple version ranges. CVE-2026-7808 (< 1.16.0) and CVE-2026-5388 (< 1.15.0) are the most severe: active/dangerous content including <script> and <style> tags can survive sanitization, enabling XSS in applications that rely on justhtml for user-content rendering. CVE-2026-8445 (< 1.12.0) fails to escape angle brackets in Markdown conversion, creating injection paths. CVE-2026-9769 (< 1.10.0) allows uncontrolled recursion leading to DoS during document construction. CVE-2026-4671 (< 1.18.0) introduces DoS via CSS selector handling. Any web application using justhtml to sanitize or render user-supplied HTML is potentially affected.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade justhtml to ≥ 1.18.0 (addresses all listed CVEs). Audit all code paths that pass user-controlled content through justhtml sanitization or Markdown conversion.

CVE-2026-10053 — GitLab CE/EE (Authenticated Information Disclosure)

  • Severity: CVSS 8.5
  • EPSS: 0.0 — newly published
  • Technical detail: Affects GitLab CE/EE versions 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Under certain conditions, an authenticated user can access data they should not be authorized to view. Full technical details are limited in current disclosure, but the affected version range is broad and overlaps with the actively exploited CVE-2026-19478 (see ONGOING). Organizations running GitLab should treat this as part of a consolidated upgrade to the latest patched release.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade to GitLab 19.0.6, 19.1.4, or 19.2.2 as appropriate. This upgrade also addresses the actively exploited CVE-2026-19478.

ONGOING:

  • CVE-2026-73570 (Zimbra ZCS): KEV deadline TODAY (2026-08-24) — patch immediately; audit for web shells and unauthorized accounts.
  • CVE-2026-68820 (Windows AFD/Lazarus): KEV deadline 2026-08-25 — apply August Patch Tuesday without further delay.
  • CVE-2026-19478 (GitLab): Actively exploited — upgrade to latest patched release (see CVE-2026-10053 entry above).
  • CVE-2026-72529 / CVE-2026-72530 (TrueConf): KEV deadline passed 2026-08-23 — patch or block port 4307/TCP immediately.
  • CVE-2026-64849 (MLflow SSRF): KEV deadline 2026-09-02 — patch and audit IAM.
  • CVE-2026-69414 (Microsoft Defender ShieldBreak): No patch available — monitor MSRC.
  • CVE-2026-76604 cluster (Fabrik/Joomla), CVE-2026-78003 (Mailgun/WordPress), CVE-2026-71513 cluster (NLTK), CVE-2026-47895 (strongSwan): Patch per prior guidance.

European Advisories

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

Notable European-relevant development: Heise Security reports that the UK government has confirmed a cyberattack that caused a power station to shut down for four days. Authorities have issued warnings while seeking to avoid public alarm. Attribution and technical details have not been publicly released. European critical infrastructure operators should treat this as a relevant threat signal and review OT/IT boundary controls and incident response readiness.

ONGOING:

  • WID-SEC-2026-2962 (Apache CloudStack): Upgrade to ≥ 4.20.4.0 or ≥ 4.22.2.0; no change.
  • WID-SEC-2026-2964 (TP-Link Omada): Apply firmware updates; no change.
  • WID-SEC-2026-2963 (PTC Windchill/FlexPLM): Apply PTC patches; no change.
  • WID-SEC-2026-2951 (Microsoft Azure/Entra ID/Exchange): Apply current Microsoft patches; no change.

Active Threats and Campaigns

ToxicPanda 2.0 — STATUS CHANGE: Bleeping Computer reports that ToxicPanda has expanded its targeting to 349 applications (up from prior reporting) and added support for 167 remote commands. A new capability abuses VPN permissions to block Google Play, likely to prevent security updates or detection. Organizations with BYOD policies or mobile device management should update detection rules and review MDM policy enforcement.

ONGOING:

  • RedC2 4.0 npm supply chain: 14 trojanized packages — audit npm dependency trees, rotate secrets from affected build environments.
  • SynkLoader / Microsoft Teams phishing: Enforce Teams external access policies; monitor EDR for fake lock screen activity.
  • FTP Banner RAT delivery (E4del / PINHOLE): Hunt for anomalous FTP banner content and unexpected outbound connections.
  • Berlin Senatsverwaltungen cyberattack: Two agencies remain isolated; no new public developments.

Security News and Context

  • UK power station cyberattack confirmed: The British government has confirmed attackers shut down a power station for four days; warnings have been issued to the sector. Heise Security
  • ENUM domain hijacking: A German security researcher demonstrated near-interception of military phone calls by hijacking ENUM domains from negligent island nations; security authorities responded only after a missile strike prompted urgency. Heise Security
  1. Zimbra ZCS (CVE-2026-73570): KEV deadline is today — patch immediately; audit for web shells and unauthorized accounts.
  2. Windows AFD (CVE-2026-68820): KEV deadline tomorrow (2026-08-25) — apply August Patch Tuesday now if not yet done.
  3. StackGres (CVE-2026-78155): Upgrade to ≥ 1.18.9; audit Kubernetes RBAC bindings for StackGres service accounts.
  4. exceljs (CVE-2026-78207 cluster): Migrate to exceljs-hardened ≥ 5.0.0; validate all user-supplied file inputs in Node.js applications.
  5. justhtml (CVE-2026-7808 cluster): Upgrade to ≥ 1.18.0; audit all user-content rendering paths.
  6. GitLab (CVE-2026-10053): Upgrade to 19.0.6 / 19.1.4 / 19.2.2 — also resolves actively exploited CVE-2026-19478.
  7. ToxicPanda 2.0: Update mobile threat detection rules; review MDM VPN permission policies for BYOD devices.
  8. Critical infrastructure operators: Review OT/IT boundary controls and incident response playbooks in light of confirmed UK power station attack.
  9. TrueConf (CVE-2026-72529/72530): KEV deadline passed — patch or block port 4307/TCP immediately if not yet done.
  10. Continue remediation of previously reported items: CVE-2026-64849 (MLflow — deadline 2026-09-02), CVE-2026-76604 cluster (Fabrik/Joomla), CVE-2026-78003 (Mailgun/WordPress), CVE-2026-71513 cluster (NLTK), CVE-2026-47895 (strongSwan), CVE-2026-69414 (Defender ShieldBreak — no patch, monitor MSRC).