PQC HAWK withdrawal and open source CVEs

A lattice attack on the HAWK post-quantum signature candidate led to its withdrawal from NIST consideration. Several open source projects also disclosed authentication bypass and information disclosure flaws.

HAWK withdrawn after reduced-dimension lattice attack

Discussion on the pqc-forum examined a key recovery attack on HAWK-n that reduces to the shortest vector problem in dimension n/2 + 1. Anthropic-linked AI-assisted lattice work effectively halves the scheme dimension claims and prompted official withdrawal from the NIST PQC signatures round. Developers tracking post-quantum standardization should remove HAWK from candidate lists.

Malware in fake Perl SSL certificate package

oss-security reported CVE-2026-97230 in IO::Socket::SSL::SelfCertificate version 1.00 for Perl. The fake CPAN distribution contains malware that executes Python code fetched from an obfuscated URL. Perl operators should treat the module as malicious and remove it.

OpenStack Swift tempurl cross-container disclosure

OpenStack issued OSSA-2026-041 for CVE-2026-97149 in Swift. The tempurl middleware permits cross-container object disclosure via account-level keys. Deployments that rely on Swift temporary URLs should apply fixes to block unintended object access.

Lemonldap::NG unauthenticated OAuth2 introspection

CVE-2026-92288 affects Lemonldap::NG::Portal releases from 2.20.0 before 2.21.6 and from 2.22.0 before 2.23.4. The checkEndPointAuthenticationCredentials path fails to verify the client secret of a public Relying Party, allowing unauthenticated OAuth2 token introspection. Sites running the portal need to upgrade to patched versions.

Airflow HashiCorp Vault team-scope bypass

CVE-2026-97636 in the Apache Airflow HashiCorp provider lets a user-controlled key bypass team-scope guards in the Vault secrets backend. The issue is rated moderate. Airflow operators using HashiCorp Vault should constrain key paths and install updates.

sudo TZ bypass of time-based rules

CVE-2026-96512 reports that sudo still allows the TZ environment variable to affect NOTBEFORE and NOTAFTER evaluation. The parsing behavior can bypass time-based authorization rules. Administrators who depend on sudo time restrictions should watch for corrective releases.

OpenStack Zaqar empty signature auth bypass

OSSA-2026-042 covers CVE-2026-97404 in OpenStack Zaqar. An empty URL-Signature header bypasses authentication on the WSGI transport. Zaqar deployments should update to restore proper signature checks.

Lemonldap::NG Handler path rule bypass

CVE-2026-95811 affects Lemonldap::NG::Handler in ranges before 2.16.10, 2.21.6, and 2.23.4. Equivalent path spellings can bypass locationRules through a mismatch between REQUEST_URI and decoded routing. Operators should upgrade to close the access-control gap.