Open Source Security Alert: What You Need to Know
Three Security Advisories Worth Your Attention This Week
Our monitoring picked up three security advisories this week that push beyond routine patch chores: a critical unauthenticated credential disclosure in Apache Artemis, a critical remote code execution in IBM’s Langflow, and a high-severity flaw in Docker’s AI Sandboxes. Two of the three are classified critical, and one already has a public proof-of-concept. If your stack runs any of these components, upgrading (or at minimum checking your exposure) belongs on the front of this week’s to-do list.
1. Apache Artemis 2.57.0 — Critical Unauthenticated Credential Disclosure (CVE-2026-49364)
Apache Artemis, the high-performance open-source message broker, has patched a critical vulnerability in its cluster discovery mechanism. An unauthenticated network-adjacent attacker can leverage the discovery handshake to capture cluster administrative credentials during the initial cluster connection. Because the attack requires no authentication and gives up administrative credentials, it allows a complete takeover of the messaging cluster.
Affected versions run from Artemis 2.50.0 through 2.56.0, and historically from ActiveMQ Artemis 1.0.0 through 2.44.0. The fix ships in version 2.57.0. Anyone running an affected broker should treat this as an upgrade-now item rather than a next maintenance-window item.
Learn more: CVE-2026-49364 on NVD.
2. IBM Langflow — Critical Remote Code Execution via Malicious Components (CVE-2026-12944)
Langflow, the low-code visual AI workflow builder, carries a critical (CVSS 9.6) vulnerability in its component validator. Langflow OSS versions 1.0.0 through 1.10.0 allow an attacker who can submit or edit flow components to execute arbitrary Python code with root privileges (UID 0) on the server by submitting components that import socket or urllib. The flawed validator incorrectly returns validated: true, giving a false sense of security.
That root execution unlocks several damaging follow-ons: theft of AWS credentials via IMDSv1 SSRF with full IAM role permissions, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services (PostgreSQL, Redis) inside the Docker network. A public proof-of-concept has been published, so this one is worth prioritising highly.
The fix arrives in a Langflow release later than 1.10.0 that includes a corrected component scanner. See the IBM advisory for the exact patched version.
3. Docker AI Sandboxes — High-Severity Socket Relay Flaw (CVE-2026-79994)
Docker AI Sandboxes, Docker’s isolation feature for AI workloads, contains a high-severity (CVSS 4.0 8.7) flaw in its guest-to-host Unix-domain socket relay. The relay validates that a socket path is inside an authorised workspace but later reconnects using the pathname — leaving a time-of-check/time-of-use gap. A malicious guest can swap an intermediate directory for a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. That can expose data or host-side capabilities of the targeted socket.
Affected versions are the Docker Sandboxes packages 0.37.0 through 0.42.0. The fix lands in the v0.42.0 release. Docker’s hardening guidance in its Sandboxes isolation documentation covers the mitigations in the interim.
How We Stay Informed
These advisories were surfaced by monitoring CVE feeds and vendor release announcements — the same signal pipeline that powers our regular Weekly FOSS Release Digest. Keeping pace with security news across the open-source ecosystem is a lot easier when you lean on your distribution’s security mailing list and dedicated CVE trackers.
Looking to harden your own server or route around patch windows with a safer stack? Browse the full directory of open-source tools, or submit a tool you think the community should know about.