Log in Start free

Vulnerability · Published Sep 30, 2026 · Assigned by GitHub_M

CVE-2026-55094Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

High 8.7

In plain English

A high-severity improper input validation in taskcluster from taskcluster. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.4%top 63.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.

Affected products (as reported)

VendorProductVersions
taskcluster taskcluster < 100.3.0

Weakness: CWE-20, CWE-94, CWE-95, CWE-250, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References