Bug bounty

Bug bounty roundup: 11 disclosed reports worth reading

Eleven HackerOne reports disclosed from 26 October to 8 November 2026, from MariaDB and curl to Discourse and Gutenberg, with what broke and how to check.

By Yaali. November 9, 2026, 7 min read, Bug bounty, Vulnerabilities.

This roundup covers 11 bug bounty reports that HackerOne programs made public between 26 October and 8 November 2026. Only two reports from the last 48 hours had full write-ups in the archives we read, so we widened the window back to 26 October and skipped everything the 6 and 8 November roundups already covered. Five MariaDB connector reports share two sections, and the notes stay at a defender's level.

The theme is client-side trust. Command-line tools ran SQL built from names a hostile database chose, drivers let server-supplied bytes steer memory writes, and curl completed a TLS handshake its own documentation says it should refuse. None of the 11 reports lists a bounty.

Table of eight report groups ranked by severity: MariaDB CLI SQL injection CVSS 7.7, Discourse temp file read, MariaDB Connector/C++ savepoint injection 6.9, Connector/ODBC memory bugs, curl wolfSSL no-certificate accept, Gutenberg mail relay, curl known_hosts prefix match and a Weblate crash

SQL injection in MariaDB's own command-line tools

mariadb-show --count --verbose lists tables and then runs a SELECT COUNT(*) query for each name returned by SHOW TABLES, with the table name pasted in without escaping its surrounding backticks. vortfu showed that a table whose name is itself crafted SQL makes the tool run that SQL under the privileges of whoever started it. The same report flagged unquoted server names in mariadb-dump --system=servers, an infinite loop in mariadb-dump --events, and buffer overflows on very long 'user'@'host' names.

The archive links the report to CVE-2026-86047 (CVSS 7.7), fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Upgrade before running dump or show tools against databases where other people can create objects, such as shared hosting or customer schemas. Program: MariaDB. Severity: high. Reporter: vortfu. Report: https://hackerone.com/reports/3849007

Discourse leaked other users' temp files through an image upload

Since 2018 Discourse has forced ImageMagick to choose its decoder from the file extension, so a file's internal magic bytes cannot route it to a risky coder. fizzi found that the HEIF-to-JPEG conversion path added in 2020 skipped that safeguard. A file saved with a .heic extension but containing PostScript was handed to Ghostscript, which even in its restricted mode can read files under /tmp. The converted image, stored as an ordinary public upload, became the channel: whatever the conversion rendered was served back with no authentication, including other users' in-flight upload bodies, inbound email attachments and conversion intermediates. The fix restores the explicit decoder prefix on the HEIF path. It is reachable by any logged-in user, and by anonymous senders when inbound email is enabled, so update and confirm it is patched. Program: Discourse. Severity: medium. Reporter: fizzi. Report: https://hackerone.com/reports/3738834

MariaDB Connector/C++ turned a savepoint name into arbitrary SQL

fg0x0 filed five reports against MariaDB's client connectors on 4 November, two in Connector/C++. In the first, createConnection computes the right client capability flags and then discards them, passing a hardcoded multi-statement flag to the connect call, so stacked statements run even when the application set allowMultiQueries to false. Separately, setSavepoint and releaseSavepoint concatenate the application-supplied savepoint name into SQL with no quoting, so a savepoint name carrying a semicolon and a second statement runs that statement (CVSS 6.9).

The second Connector/C++ report is a remote crash. When the server sets the session-state-changed flag, the driver reads a session-tracking variable name and calls std::stoi on it. That name is never numeric, so the call always throws an exception of a type the driver and a correct application do not catch, aborting the process. Two packets from a hostile server end a long-running client holding a connection pool (CVSS 4.1). Program: MariaDB. Reporter: fg0x0. Reports: https://hackerone.com/reports/3890329 and https://hackerone.com/reports/3890352

Three Connector/ODBC memory bugs a hostile server can steer

The other three fg0x0 reports hit MariaDB Connector/ODBC, all memory-corruption bugs reachable without special options. SQLGetDescRec clears the error record using the statement-handle macro on a handle that is actually a smaller descriptor object, so every call writes 13 bytes past the allocation; one field used as the write offset is filled from the server's version string, so a long enough version string lets the server pick where a later write lands (type confusion, CVSS 5.7). SqlwcsOctetLen measures a UTF-16 string with a byte-oriented helper, so ordinary characters whose low byte looks like a surrogate lead make the scan run past the buffer and send client memory to the server as SQL text (out-of-bounds read, CVSS 5.3). The third leaves an array offset stale after an aborted parameter-array execute, so the next batch reads out of bounds (CVSS 5.0).

A default DSN does not require TLS, so the server-influenced write is reachable by a man-in-the-middle. Turn on full certificate verification for ODBC connections and update to fixed releases. Program: MariaDB. Severity: medium. Reporter: fg0x0. Reports: https://hackerone.com/reports/3891337, https://hackerone.com/reports/3920633 and https://hackerone.com/reports/3920647

curl with wolfSSL accepted a server that sent no certificate

Several curl TLS reports went public on 26 October. The clearest, rated medium, is in curl built against wolfSSL. A normal request with peer and host verification on completed a TLS 1.2 handshake with a server that presented no certificate at all, using an anonymous cipher suite, reported success, and sent the credentials. curl's own documentation says the connection must fail when the certificate cannot be proved to be signed by a CA, and OpenSSL and GnuTLS builds refuse the same server. The missing-certificate check existed only on the IP-literal code path, not the hostname path.

Anonymous cipher suites are enabled by default in several packaged wolfSSL builds, including Debian's, so this is not a self-inflicted configuration. If you ship software built on curl with wolfSSL, check the build and update; the fix adds a peer-certificate check whenever verification is requested. The report's CVE number is not yet in the official registry, so we omit it. Program: curl. Severity: medium. Reporter: matty69v. Report: https://hackerone.com/reports/4128428

An unauthenticated mail relay in the Gutenberg Form block

zadwon reported that the experimental Form block in the Gutenberg plugin version 22.2.0 registers its email handler for unauthenticated requests and then trusts the client-supplied recipient field without validation. A page carrying a Form block exposes the nonce and endpoint in its HTML, so anyone could send mail to any address through the site, turning it into an open relay for spam and phishing and damaging the domain's sending reputation. There was no rate limiting and no sender verification. If you have enabled the Form and input blocks, turn them off until a fixed build ships and watch mail logs for submissions to external addresses. Program: WordPress. Reporter: zadwon. Report: https://hackerone.com/reports/3460138

A curl known_hosts entry that matched more hosts than it should

samueloph found that curl's libssh2 backend, when forcing a host key type from a known_hosts entry written in the [name]:port form SSH uses for non-default ports, compared the stored name against the connection host using a length taken from the stored entry. That is a prefix match: an entry for [10.0.0.1]:2222 also matches 10.0.0.12, and [git.example.co]:2222 also matches git.example.com. If such an entry sits before the real host's entry with a different key type, curl forces that other type and a man-in-the-middle server offers it. The preconditions match CVE-2026-87865: the libssh2 backend and an application key callback that trusts new hosts. The fix is an exact-length comparison. Program: curl. Severity: low. Reporter: samueloph. Report: https://hackerone.com/reports/4112709

A crafted filename that stopped Weblate's translation discovery

sumit-sabhaya found that Weblate's translation-finder library, when building a file mask from a path, interpolates a value derived from the filename into the replacement string of a regular-expression substitution. A filename with backslash-escaped tokens such as \g<99> or \X is read as substitution syntax and raises an uncaught error that aborts discovery for the whole repository. Anyone with commit access to a scanned repository can push one such filename and keep the job broken until the file is removed; the crash depends on the filename alone, so content filtering does not help. The fix passes the value as a literal replacement through a callback. Program: Weblate. Severity: low. Reporter: sumit-sabhaya. Report: https://hackerone.com/reports/4044441

What to check in your own code

Two habits would have caught most of this batch. Treat a database, an SSH server or a TLS peer as untrusted input in client code: verify certificates fully, including the hostname, and never build SQL or a file path from a name the other side chose without quoting it. And when you add a route, handler or conversion path, diff it against the closest sibling that already does the safe thing, since several of these bugs are one code path that dropped a check its neighbour still has.

Our web application penetration testing tests authorization and input handling across real user roles, and red team code review reads the source for the missing checks above. Open the chat and Yaali, our AI agent, will pass your question to an engineer.