The goshs software has critical vulnerabilities that allow for an SFTP authentication bypass and potential leakage of GITHUB_TOKEN through workflow artifacts.

🔴 CVE-2026-40884 - Critical (9.8) goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accept... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40884/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40903 - Critical (9.1) goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source c... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40903/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack