# \#security **URL:** https://community.cumulocity.com/tag/security/1655.md [Latest](https://community.cumulocity.com/latest.md) · [Categories](https://community.cumulocity.com/categories.md) · [Tags](https://community.cumulocity.com/tags.md) --- ## [Security Advisory: Customer Microservices and Credential Configuration Review](https://community.cumulocity.com/t/security-advisory-customer-microservices-and-credential-configuration-review/15215)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [September 29, 2026, 6:00am UTC](https://community.cumulocity.com/t/security-advisory-customer-microservices-and-credential-configuration-review/15215 "2026-09-29T06:00:33Z")
Audience: Microservice Developers and Tenant Administrators Applies to: Cumulocity SaaS and Self-Hosted Overview As part of an internal security review, we identified that some customer-hosted microservices are built u… --- ## [Security Advisory: Vulnerabilities in WebSDK @c8y/bootstrap package](https://community.cumulocity.com/t/security-advisory-vulnerabilities-in-websdk-c8y-bootstrap-package/15179)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 1:06pm UTC](https://community.cumulocity.com/t/security-advisory-vulnerabilities-in-websdk-c8y-bootstrap-package/15179 "2026-09-10T13:06:09Z")
Date: 10th September 2026 Severity: Critical/ High Audience: Developers building custom applications using Web SDK & Cumulocity environment owners Action Required: Update custom applications and plugins & upgrade en… --- ## [Security Advisory: Critical Linux Kernel Vulnerability "Copy Fail" (CVE-2026-31431)](https://community.cumulocity.com/t/security-advisory-critical-linux-kernel-vulnerability-copy-fail-cve-2026-31431/14559)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [May 8, 2026, 11:35am UTC](https://community.cumulocity.com/t/security-advisory-critical-linux-kernel-vulnerability-copy-fail-cve-2026-31431/14559 "2026-05-08T11:35:09Z")
Date: May 8, 2026 Action Required for Self-Hosted Customers We are issuing this advisory regarding the recently identified “Copy Fail” (CVE-2026-31431) vulnerability. This is a critical Local Privilege Escalation (LPE) … --- ## [Security Update: Cumulocity Not Affected by Axios Supply Chain Attack](https://community.cumulocity.com/t/security-update-cumulocity-not-affected-by-axios-supply-chain-attack/14450)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [April 2, 2026, 5:04pm UTC](https://community.cumulocity.com/t/security-update-cumulocity-not-affected-by-axios-supply-chain-attack/14450 "2026-04-02T17:04:06Z")
Date: April 2, 2026 Background A critical software supply chain compromise was identified involving the widely used JavaScript HTTP client Axios. Threat actors gained unauthorized access to a primary maintainer’s npm a… --- ## [Security Update: Trivy Supply Chain attack Investigation details](https://community.cumulocity.com/t/security-update-trivy-supply-chain-attack-investigation-details/14447)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [April 2, 2026, 5:04pm UTC](https://community.cumulocity.com/t/security-update-trivy-supply-chain-attack-investigation-details/14447 "2026-04-02T17:04:02Z")
Date: April 2, 2026 Overview In response to the recently disclosed supply chain vulnerability affecting certain versions of Trivy, our Security Operations and Engineering teams immediately initiated a comprehensive inte… --- ## [Changes to SSL certificate signing for cumulocity.com certificates and subdomains](https://community.cumulocity.com/t/changes-to-ssl-certificate-signing-for-cumulocity-com-certificates-and-subdomains/14341)
**Author:** [@Thomas\_Schuller](https://community.cumulocity.com/u/Thomas_Schuller)\ **Replies:** 0\ **Last updated:** [March 13, 2026, 11:23am UTC](https://community.cumulocity.com/t/changes-to-ssl-certificate-signing-for-cumulocity-com-certificates-and-subdomains/14341 "2026-03-13T11:23:50Z")
Executive summary What has happened? The certificate supplier used by Cumulocity has changed their method of signing the certificates and chaining. This only impacts the platform certificate provided by Cumulocity, … --- ## [Update: “MongoBleed” Vulnerability does not impact Cumulocity](https://community.cumulocity.com/t/update-mongobleed-vulnerability-does-not-impact-cumulocity/14173)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [January 7, 2026, 1:06pm UTC](https://community.cumulocity.com/t/update-mongobleed-vulnerability-does-not-impact-cumulocity/14173 "2026-01-07T13:06:37Z")
We are aware of reports concerning the MongoBleed vulnerability leading to critical memory leak and sensitive data extraction affecting MongoDB deployments. Following a detailed review of Cumulocity’s architecture, we co… --- ## [CVE-2025-55182: React2Shell Vulnerability](https://community.cumulocity.com/t/cve-2025-55182-react2shell-vulnerability/14107)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [December 10, 2025, 7:17am UTC](https://community.cumulocity.com/t/cve-2025-55182-react2shell-vulnerability/14107 "2025-12-10T07:17:49Z")
Overview A recently disclosed React2Shell vulnerability affects applications that use React Server Components (RSC) or frameworks that implement RSC infrastructure. The vulnerability allows unauthenticated remote code ex… --- ## [CVE-2025-30065: Remote code execution in Apache Parquet](https://community.cumulocity.com/t/cve-2025-30065-remote-code-execution-in-apache-parquet/12168)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 10:11am UTC](https://community.cumulocity.com/t/cve-2025-30065-remote-code-execution-in-apache-parquet/12168 "2025-04-23T10:11:07Z")
Overview A recent security vulnerability in the Parquet software used as part of Dremio and Cumulocity DataHub was published with CVE-2025-30065. The vulnerability allows attackers with write access to data lake files to… --- ## [\[Update\] Cumulocity Platform not affected by Kubernetes NGINX Controller vulnerabilities](https://community.cumulocity.com/t/update-cumulocity-platform-not-affected-by-kubernetes-nginx-controller-vulnerabilities/12075)
**Author:** [@c8y\_security](https://community.cumulocity.com/u/c8y_security)\ **Replies:** 0\ **Last updated:** [March 31, 2025, 6:41am UTC](https://community.cumulocity.com/t/update-cumulocity-platform-not-affected-by-kubernetes-nginx-controller-vulnerabilities/12075 "2025-03-31T06:41:48Z")
Date: 2025-03-27 Overview A recent security vulnerability (named as #IngressNightmare) with the following CVEs: CVE-2025-1974 CVE-2025-1098 CVE-2025-1097 CVE-2025-24514 CVE-2025-24513 has been identified in Kubernete…