XFS local escalation and OpenStack SSRF lead disclosures

Security traffic on 2026-09-04 focused on a Linux kernel XFS privilege escalation and three authenticated SSRF flaws in OpenStack Glance. Apache Allura and SkyWalking also shipped fixes for multiple stored XSS, SSRF, and information-exposure issues.

Linux XFS EXCHANGE_RANGE reflink flag clearing

CVE-2026-80530 was disclosed for the Linux XFS filesystem, where mishandling of the reflink flag during EXCHANGE_RANGE operations enables local privilege escalation. The issue affects kernel deployments that expose XFS to untrusted local users. Distributors and operators should treat the flaw as a priority local-attack-surface item and apply available patches.

OpenStack Glance multiple SSRF in image APIs

OpenStack security advisory OSSA-2026-038 covers three SSRF vulnerabilities, CVE-2026-71196, CVE-2026-71197, and CVE-2026-71198, in Glance web-download and HTTP image APIs. Authenticated callers can coerce the service into fetching internal URLs and exfiltrating data. Glance operators need to upgrade to releases that close these authenticated internal-access paths.

Apache Allura stored XSS via markdown HTML

CVE-2026-80180 describes a stored XSS vulnerability in Apache Allura through 1.20.0 caused by insufficient handling of HTML inside markdown processing. The flaw was corrected in 1.21.0. Sites that accept user markdown should move to the fixed release to block persistent script injection.

Apache Allura webhook SSRF

CVE-2026-80181 reports server-side request forgery in Apache Allura webhooks, likewise fixed in 1.21.0. An attacker can induce the server to issue requests to unintended internal targets. Administrators running Allura are advised to upgrade to eliminate the SSRF vector.

Apache SkyWalking stored XSS in Booster UI

CVE-2026-85229 is a CWE-79 stored XSS in Apache SkyWalking Booster UI dashboard widgets and is noted as an incomplete fix of the earlier CVE-2025-54057. Dashboard users remain exposed until the fuller remediation is applied. Operators should install the updated packages that correctly sanitize widget content.

Apache Allura information exposure via search

CVE-2026-81270 covers a moderate information-exposure issue reachable through Allura search functionality and fixed in 1.21.0. Search results could reveal data that should remain restricted. Upgrading removes the unintended disclosure path.

Apache SkyWalking PagerDuty cleartext routing key

CVE-2026-71216 records that SkyWalking's PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. The low-severity flaw can expose the key on the network path. Deployments using the hook should ensure encrypted transport or obtain the corrected release.

Apache Allura stored XSS via code repositories

CVE-2026-80190 is a low-severity stored XSS affecting Allura SVN repository views, mitigated in 1.21.0 with Content-Security-Policy adjustments. Repository content could previously inject scripts into browsers of other users. The 1.21.0 release supplies the necessary defenses.