CVE-2026-55094CWE-20CWE-250CWE-306CWE-94CWE-95code-injection

CVE-2026-55094

published September 30, 2026

CVSS
8.7
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00423 · 35.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-250 · Execution with Unnecessary Privileges; CWE-306 · Missing Authentication for Critical Function; CWE-94 · Improper Control of Generation of Code ('Code Injection'); CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-09-30T22:18Z
References (6)
https://bugzilla.mozilla.org/show_bug.cgi?id=2045091 · [email protected]https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b · [email protected]https://github.com/taskcluster/taskcluster/issues/8716 · [email protected]https://github.com/taskcluster/taskcluster/pull/8718 · [email protected]https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0 · [email protected]https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38 · [email protected]
EPSS history
Timeline
  • 02 OCT 03:44Z
    EPSS moved — → 1%
    epss
  • 30 SEP 17:22Z
    Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)
    cvelistv5