actix hang, Airflow team-scope CVEs, Gitea file read, OpenSSH 10.5

Security traffic on oss-security covered a connection-slot hang in actix-multipart, three related team-scope bypasses in Apache Airflow cloud secret backends, an arbitrary file read fixed in Gitea and Forgejo, and the OpenSSH 10.5 release. The Airflow issues share a common multi-team guard failure pattern across Azure, Amazon, and Yandex providers.

actix-multipart field parser hang on truncated boundary

A single-message oss-security disclosure reports a CWE-400 hang in actix-multipart 0.8.0. The field parser can hang indefinitely after EOF when it sees a truncated boundary prefix, leaking the connection slot. Actix-based services that accept multipart uploads should treat this as a denial of service risk until patched.

CVE-2026-68870: Airflow Azure Key Vault team-scope bypass

CVE-2026-68870 affects the Apache Airflow Microsoft Azure provider Key Vault backend. In multi-team mode the team-scope guard can be bypassed so one team resolves another team's Connection or Variable. The moderate-severity issue matters for shared Airflow deployments that isolate secrets by team.

CVE-2026-59774: arbitrary file read via Org-mode INCLUDE in Gitea and Forgejo

Gitea and Forgejo released fixes for CVE-2026-59774. The Org-mode #+INCLUDE directive allowed arbitrary file read on affected instances. Operators of self-hosted Gitea or Forgejo forges should upgrade to obtain the fix.

CVE-2026-68872: Airflow Amazon SSM and Secrets Manager team-scope bypass

CVE-2026-68872 covers the Apache Airflow Amazon provider backends for SSM and Secrets Manager. As with the Azure case, the team-scope guard can be bypassed to resolve another team's Connection or Variable. Shared multi-team Airflow instances using these backends are affected at moderate severity.

OpenSSH 10.5 released

OpenSSH 10.5 was announced on oss-security. The project notes a shift to more frequent releases after AI-assisted security reports that may also reach adversaries. Administrators who track OpenSSH should expect a faster update cadence.

CVE-2026-68871: Airflow Yandex Lockbox team-scope bypass

CVE-2026-68871 reports a moderate cross-team secret bypass in the Apache Airflow Yandex provider Lockbox backend when multi-team mode is enabled. One team can resolve another team's Connection or Variable, matching the pattern in the Azure and Amazon provider issues.