CWE-441.

In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

BuildKit improperly handles special files in build snapshots

• moby BuildKit
• CWE-441

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

• Prototype pollution
• CWE-441

>=1.15.2, <1.20.0 · fixed in 1.20.0

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

• Open redirect
• CWE-441

>=1.17.0, <1.20.0 · fixed in 1.20.0

Google Chrome: Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a…

• Google Chrome
• CWE-441

Google Chrome: Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote…

• Google Chrome
• CWE-441

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

• Elastic Kibana
• CWE-441

kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

• kyverno
• CWE-441

Capgo Build Upload Proxy Authorization Bypass via TUS Resource

• Cap-go capgo.app
• CWE-441

Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

• Red Hat OpenShift Container Platform 4.17
• Red Hat OpenShift Container Platform 4.18
• CWE-441

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

• Authentication bypass
• CWE-441

<0.5.2 · fixed in 0.5.2

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

• Path traversal
• CWE-441

<0.22.0 · fixed in 0.22.0

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

• Path traversal
• Information disclosure

<0.22.0 · fixed in 0.22.0

Azure Arc Elevation of Privilege Vulnerability

• Microsoft Azure ARC
• CWE-441

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

• CWE-441

<1.14.7 · fixed in 1.14.7

Metacat acts as unintended proxy to backend Apache SOLR engine

• NCEAS metacat
• CWE-441

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

• Server-side request forgery (SSRF)
• CWE-20

>=6.0.2, <6.7.0 · fixed in 6.7.0

Google Chrome: Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47…

• Google Chrome
• CWE-441

In platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due to a confused deputy.

• Google Android
• CWE-441

In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

In multiple files, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

In multiple files, there is a possible out-of-bounds read due to type confusion.

• Google Android
• CWE-441

In multiple files, there is a possible way to obtain signatures due to type confusion.

• Google Android
• CWE-441

Out-of-bounds write in Google Android

• Google Android
• Memory corruption
• CWE-441

In CPM, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy.

• Google Android
• CWE-441

In CPM, there is a possible information disclosure due to a confused deputy.

• Google Android
• CWE-441

Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

• Red Hat build of Apache Camel - HawtIO 4
• CWE-441

A type confusion issue was addressed with improved memory handling.

• Apple iOS and iPadOS
• Apple macOS
• CWE-441

Google Chrome: Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote…

• Google Chrome
• CWE-441

Google Chrome: Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote…

• Google Chrome
• CWE-441

Google Chrome: Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote…

• Google Chrome
• CWE-441

Google Chrome: Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a…

• Google Chrome
• CWE-441

In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy.

• Google Android
• CWE-441

In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy.

• Google Android
• CWE-441

In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy.

• Google Android
• CWE-441

In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy.

• Google Android
• CWE-441

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy.

• Google Android
• CWE-441

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy.

• Google Android
• CWE-441

In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy.

• Google Android
• CWE-441

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy.

• Google Android
• CWE-441

In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy.

• Google Android
• CWE-441

Microsoft Windows Speech Tampering Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-441

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

• Server-side request forgery (SSRF)
• CWE-441

<3.10.3 · fixed in 3.10.3

Workload identity attestation generated before login host validation in Snowflake drivers

• Snowflake Connector for Python
• Snowflake Go Driver
• Hard-coded credentials
• CWE-441

Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

• sim
• CWE-441

Google Chrome: Confused deputy in CredentialProvider in Google Chrome on on Windows prior to…

• Google Chrome
• CWE-441

Server-side request forgery in SonicWall SMA1000

• SonicWall SMA1000
• Server-side request forgery (SSRF)
• CWE-441

Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

• ellite Wallos
• Server-side request forgery (SSRF)
• CWE-441

Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• CWE-441

MagicMirror: ssrf calendar .js

• Server-side request forgery (SSRF)
• CWE-441

<2.37.0 · fixed in 2.37.0

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure

• Elastic Eck Operator
• CWE-441

Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• CWE-441

Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• CWE-441

Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• CWE-441

Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials

• Wei-Shaw sub2api
• Path traversal
• CWE-441

Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• CWE-441