CVE-2026-55094: Input Validation Flaw

Description

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.

Is your site exposed to CVE-2026-55094?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-20 Improper Input Validation

CWE-94 CWE-94

CWE-95 CWE-95

CWE-250 CWE-250

CWE-306 Missing Authentication

References

Other References

https://bugzilla.mozilla.org/show_bug.cgi?id=2045091 https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b https://github.com/taskcluster/taskcluster/issues/8716 https://github.com/taskcluster/taskcluster/pull/8718 https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0 https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38

Frequently Asked Questions

What is CVE-2026-55094? +

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.

How do I check if I'm vulnerable to CVE-2026-55094? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-13826

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is …

CVE-2026-62658

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to …

CVE-2024-54011

Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in …

CVE-2026-56349

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail …

CVE-2026-6409

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured …

CVE-2026-56732

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection …

CVE-2026-55094