{"id":"CVE-2026-55094","summary":"Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)","details":"Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.","aliases":["GHSA-ccv5-c45x-2q38"],"modified":"2026-10-02T03:47:19.395566898Z","published":"2026-09-30T17:22:52.135Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-250","CWE-306","CWE-94","CWE-95"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55094.json"},"references":[{"type":"WEB","url":"https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55094.json"},{"type":"ADVISORY","url":"https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55094"},{"type":"REPORT","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2045091"},{"type":"REPORT","url":"https://github.com/taskcluster/taskcluster/issues/8716"},{"type":"FIX","url":"https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b"},{"type":"FIX","url":"https://github.com/taskcluster/taskcluster/pull/8718"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/taskcluster/taskcluster","events":[{"introduced":"0"},{"fixed":"a1b0154b8235937657c2ded127f193b564e2334b"},{"fixed":"fe314d92315c5ca248e56d34494eac8f42eb7122"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"100.3.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v100.2.0","v100.1.1","v100.1.0","v100.0.1","v100.0.0","v99.2.1","v99.2.0","v99.1.1","v96.2.3","v99.1.0","v99.0.3","v99.0.2","v99.0.1","v99.0.0","v98.0.1","v98.0.0","v97.1.0","v97.0.1","v97.0.0","v96.7.1","v96.7.0","v96.6.2","v96.6.1","v96.6.0","v96.5.2","v96.5.1","v96.5.0","v96.4.0","v96.3.1","v96.3.0","v96.2.2","v96.2.1","v96.2.0","v96.1.0","v96.0.0","v95.1.4","v95.1.3","v95.1.2","v95.1.1","v95.1.0","v95.0.3","v95.0.2","v95.0.1","v95.0.0","v94.3.0","v94.2.0","v94.1.1","v94.1.0","v94.0.1","v94.0.0","v93.1.5","v93.1.4","v93.1.3","v93.1.2","v93.1.1","v93.1.0","v93.0.0","v92.0.2","v92.0.1","v92.0.0","v91.1.2","v91.1.1","v91.1.0","v91.0.4","v91.0.3","v91.0.2","v91.0.1","v91.0.0","v90.0.5","v90.0.4","v90.0.3","v90.0.2","v90.0.1","v90.0.0","v89.0.0","v88.1.3","v88.1.2","v88.1.1","v88.1.0","v88.0.5","v88.0.4","v88.0.3","v88.0.2","v88.0.1","v88.0.0","v87.1.3","v87.1.2","v87.1.1","v87.1.0","v87.0.0","v86.0.2","v86.0.1","v86.0.0","v85.0.1","v85.0.0","v84.2.1","v84.2.0","v84.1.2","v84.1.1","v84.1.0","v84.0.2","v84.0.1","v84.0.0","v83.10.1","v83.9.1","v83.10.0","v83.9.0","v83.8.0","v83.7.0","v83.6.0","v83.5.8","v83.5.7","v83.5.6","v83.5.5","v83.5.4","v83.5.3","v83.5.2","v83.5.1","v83.5.0","v83.4.0","v83.3.0","v83.2.4","v83.2.3","v83.2.2","v83.2.1","v83.2.0","v83.1.0","v83.0.1","v83.0.0","v82.1.0","v82.0.1","v82.0.0","v81.0.3","v81.0.2","v81.0.1","v81.0.0","v80.0.0","v79.0.0","v78.2.0","v78.1.0","v78.0.0","v77.3.1","v77.3.0","v77.2.0","v77.1.0","v77.0.0","v76.0.0","v75.0.1","v75.0.0","v74.0.1","v74.0.0","v73.0.0","v72.1.1","v72.1.0","v72.0.1","v72.0.0","v71.0.0","v70.0.0","v69.0.1","v69.0.0","v68.0.4","v68.0.3","v68.0.2","v68.0.1","v68.0.0","v67.1.0","v67.0.1","v67.0.0","v66.0.0","v65.4.0","v65.3.0","v65.2.0","v65.1.0","v65.0.2","v65.0.1","v65.0.0","v64.3.0","v64.2.8","v64.2.7","v64.2.6","v64.2.5","v64.2.4","v64.2.3","v64.2.2","v64.2.1","v64.2.0","v64.1.2","v64.1.1","v64.1.0","v64.0.0","v63.0.0","v62.0.0","v61.0.0","v60.4.2","v60.4.1","v60.4.0","v60.3.5","v60.3.4","v60.3.3","v60.3.2","v60.3.1","v60.3.0","v60.2.0","v60.1.3","v60.1.2","v60.1.1","v60.1.0","v60.0.1","v60.0.0","v59.2.0","v59.1.3","v59.1.2","v59.1.1","v59.1.0","v59.0.1","v59.0.0","v58.0.2","v58.0.1","v58.0.0","v57.1.0","v57.0.1","v57.0.0","v56.0.3","v56.0.2","v56.0.1","v56.0.0","v55.3.4","v55.3.3","v55.3.2","v55.3.1","v55.3.0","v55.2.1","v55.2.0","v55.1.1","v55.1.0","v55.0.1","v55.0.0","v54.5.0","v54.4.2","v54.4.1","v54.4.0","v54.3.1","v54.3.0","v54.2.0","v54.1.4","v54.1.3","v54.1.2","v54.1.1","v54.1.0","v54.0.0","v53.2.1","v53.2.0","v53.1.0","v53.0.0","v52.0.0","v51.1.0","v51.0.0","v50.1.3","v50.1.2","v50.1.1","v50.1.0","v50.0.0","v49.2.0","v49.1.3","v49.1.2","v49.1.1","v49.1.0","v49.0.0","v48.3.0","v48.2.1","v48.2.0","v48.1.1","v48.1.0","v48.0.0","v47.1.2","v47.1.1","v47.1.0","v47.0.3","v47.0.2","v47.0.1","v47.0.0","v46.1.1","v46.1.0","v46.0.0","v45.0.1","v45.0.0","v44.23.4","v44.23.3","v44.23.2","v44.23.1","v44.23.0","v44.22.1","v44.22.0","v44.21.0","v44.20.4","v44.20.3","v44.20.2","v44.20.1","v44.20.0","v44.19.1","v44.19.0","v44.18.0","v44.17.2","v44.17.1","v44.17.0","v44.16.4","v44.16.3","v44.16.2","v44.16.1","v44.16.0","v44.15.5","v44.15.4","v44.15.3","v44.15.2","v44.15.0","v44.15.1","v44.14.0","v44.13.7","v44.13.6","v44.13.5","v44.13.4","v44.13.3","v44.13.2","v44.13.1","v44.13.0","v44.12.3","v44.12.2","v44.12.1","v44.12.0","v44.11.2","v44.11.1","v44.11.0","v44.10.0","v44.9.2","v44.9.1","v44.9.0","v44.8.5","v44.8.4","v44.8.3","v44.8.2","v44.8.1","v44.8.0","v44.7.2","v44.7.1","v44.7.0","v44.6.1","v44.6.0","v44.5.0","v44.4.0","v44.3.1","v44.3.0","v44.2.2","v44.2.1","v44.2.0","v44.1.0","v44.0.0","v43.2.0","v43.1.0","v43.0.0","v42.1.1","v42.1.0","v42.0.0","v41.1.0","v41.0.2","v41.0.1","v41.0.0","v40.0.3","v40.0.2","v40.0.1","v40.0.0","v39.2.0","v39.1.2","v39.1.1","v39.1.0","v39.0.0","v38.0.6","v38.0.5","v38.0.4","v38.0.3","v38.0.2","v38.0.1","v38.0.0","v37.5.1","v37.5.0","v37.4.0","v37.3.0","v37.2.0","v37.1.0","v37.0.0","v36.0.0","v35.0.0","v34.0.1","v34.0.0","v33.0.0","v32.0.0","v31.0.0","v30.1.1","v30.1.0","v30.0.5","v30.0.4","v30.0.3","v30.0.2","v30.0.1","v30.0.0","v29.6.0","v29.5.2","v29.5.1","v29.5.0","v29.4.1","v29.4.0","v29.3.0","v29.2.0","v29.1.3","v29.1.2","v29.1.1","v29.1.0","v29.0.0","v29.0.1","v28.2.3","v28.2.2","v28.2.1","v28.2.0","v28.1.0","v28.0.0","v27.2.0","v27.1.0","v27.0.0","v26.0.1","v26.0.0","v25.1.1","v25.4.0","v25.3.0","v25.2.0","v25.1.0","v25.0.0","v24.3.1","clients/client-go/v24.3.1","v24.3.0","clients/client-go/v24.3.0","v24.2.0","clients/client-go/v24.2.0","v24.1.10","clients/client-go/v24.1.10","v24.1.9","clients/client-go/v24.1.9","v24.1.8","clients/client-go/v24.1.8","v24.1.7","clients/client-go/v24.1.7","v24.1.6","clients/client-go/v24.1.6","v24.1.5","clients/client-go/v24.1.5","v24.1.4","clients/client-go/v24.1.4","v24.1.3","clients/client-go/v24.1.3","v24.1.2","clients/client-go/v24.1.2","v24.1.1","clients/client-go/v24.1.1","v24.1.0","clients/client-go/v24.1.0","v24.0.1","clients/client-go/v24.0.1","v24.0.0","clients/client-go/v24.0.0","v23.0.0","clients/client-go/v23.0.0","v22.1.1","clients/client-go/v22.1.1","v22.1.0","clients/client-go/v22.1.0","v22.0.0","clients/client-go/v22.0.0","v21.3.0","clients/client-go/v21.3.0","v21.2.0","clients/client-go/v21.2.0","v21.0.0","clients/client-go/v21.0.0","v20.0.0","clients/client-go/v20.0.0","v19.0.0","clients/client-go/v19.0.0","v18.0.3","clients/client-go/v18.0.3","v18.0.2","clients/client-go/v18.0.2","v18.0.1","clients/client-go/v18.0.1","v17.0.0","clients/client-go/v17.0.0","v16.2.0","clients/client-go/v16.2.0","v16.1.0","clients/client-go/v16.1.0","v16.0.0","clients/client-go/v16.0.0","v15.0.0","clients/client-go/v15.0.0","v14.3.1","clients/client-go/v14.3.1","v14.2.0","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55094.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}