Weaknesses of type CWE-441

231 results

Deputado Confuso (Proxy ou Intermediário Não Intencional)

Quando um componente intermediário (servidor, API, função, etc.) executa ações em nome de um cliente sem validar adequadamente quem realmente autorizou aquela ação, um atacante consegue explorar a confiança já estabelecida entre esse intermediário e outros sistemas. O intermediário acaba agindo como 'procurador involuntário' do atacante, realizando operações que o sistema final nunca autorizaria se a requisição viesse diretamente do atacante.

Example

Um servidor de cache proxy que aceita requisições GET de qualquer origem e as repassa a um serviço interno sem verificar se o cliente original deveria ter acesso àqueles dados. Um atacante faz o proxy buscar informações sensíveis do servidor interno e devolver para si, usando a confiança que o servidor interno tem no proxy.

How to mitigate

Valide a identidade e autorização do cliente original antes de repassar requisições para sistemas internos; use tokens ou assinaturas criptográficas que viagem junto com a requisição; implemente listas de origem segura (whitelist) rigorosas e autenticação mútua entre componentes intermediários e backends.

CVE-2026-44964MEDIUMIn versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guardEPSS 0.3%CVE-2026-113152HIGHConfused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origEPSS 0.3%CVE-2023-33188MEDIUM Uncontrolled data used in content resolution EPSS 0.3%CVE-2026-113190HIGHConfused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass wEPSS 0.3%CVE-2026-75886HIGHOpenshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwardingEPSS 0.3%CVE-2026-113247HIGHConfused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitEPSS 0.3%CVE-2025-64123HIGHNuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS accessEPSS 0.3%CVE-2026-114612CRITICALLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyEPSS 0.3%CVE-2026-83837HIGHWindows Kernel-Mode Drivers Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-6993MEDIUMgo-kratos http.DefaultServeMux Fallback server.go NewServer confused deputyEPSS 0.3%CVE-2026-15183CRITICALInput Validation Vulnerabilities in Snowflake Spark ConnectorEPSS 0.3%CVE-2026-24470HIGHSkipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalNameEPSS 0.3%CVE-2026-106221HIGHConfused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to EPSS 0.3%CVE-2026-69531MEDIUMMicrosoft Windows Speech Tampering VulnerabilityEPSS 0.3%CVE-2026-12879MEDIUMCross-Tenant Data Exfiltration in Apigee via BigQuery Confused DeputyEPSS 0.3%CVE-2026-100625HIGHCapgo Build Upload Proxy Authorization Bypass via TUS ResourceEPSS 0.3%CVE-2026-105311HIGHConsole-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputyEPSS 0.3%CVE-2026-55225HIGHStrimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`EPSS 0.3%CVE-2026-113118HIGHConfused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web EPSS 0.3%CVE-2025-68944MEDIUMGitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.EPSS 0.3%