CERT/CC has warned that several Tenda router firmware versions contain an undocumented authentication backdoor that grants full administrative access to the web management interface. Tracked as CVE-2026-11405, the flaw lives in the login function of the router's web server: if normal password checking fails, the firmware compares the supplied password against a hidden value stored in the device configuration and, on a match, grants admin access regardless of the username. It affects models including the FH1201, W15E, AC10, AC5, and AC6, is baked into the firmware, and cannot be disabled from the interface. Tenda has not responded, so there is no fix, and public exploit tooling is already scanning for vulnerable devices.
CERT Coordination Center disclosed CVE-2026-5752, a CVSS 9.3 sandbox escape in Cohere's open source Terrarium, a Python sandbox that runs on Pyodide (a WebAssembly Python distribution for Node.js) and is used to execute untrusted or LLM-generated code inside a Docker container. The flaw lets code running inside the Pyodide sandbox traverse the JavaScript prototype chain to reach the host Node.js Function constructor, compile arbitrary JavaScript in the host realm, and execute it as root inside the container. From that point attackers can read /etc/passwd and environment variables, reach other services on the container network, and attempt a further container escape. Critically, CERT/CC notes it was unable to coordinate a patch with Cohere, so no fix has shipped. Terrarium has 312 GitHub stars and 56 forks - a moderate audience, but anyone running it is a poster-child target for prompt-injection attacks that instruct the LLM to emit sandbox-breaking code. The underlying prototype-chain traversal pattern is the same technique seen in January's CVE-2026-22686 against the enclave-vm sandbox.
TrustStrike Labs