CVE-2026-111823
Summary
| CVE | CVE-2026-111823 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-17 02:17:18 UTC |
| Updated | 2026-10-19 21:14:14 UTC |
| Description | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.003710000 probability, percentile 0.295850000 (date 2026-10-19)
Problem Types: CWE-390 | CWE-390 CWE-390 Detection of Error Condition Without Action
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/mage-ai/mage-ai/pull/6205 | [email protected] | github.com | |
| github.com/mage-ai/mage-ai/pull/6204/changes/76c4f467f3654041d8899b1c444... | [email protected] | github.com | |
| thecoregroup.net/category/the-core-group | [email protected] | thecoregroup.net | |
| github.com/mage-ai/mage-ai/pull/6204 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: On 2026-10-16, Mage merged PR #6204 (4fc5e1860260c4f772d852a28323eb65405178df) to reject unverified OAuth identities and PR #6205 (4a8904fcd2765859bd4e2b87fb284dabddb13c83) to harden version-control command execution and subprocess timeout/cancellation. These address the reported authentication bypass and shell-injection path in source. PR #6207 (9c6331991c5e6e43d755bd59c151864ef28fdc11) also removes the four version-control policy overrides used by the zero-role chain. No fixed released package or container image has been established; PyPI 0.9.80 predates these merges.