meteroid-oss vulnerabilities

Products

• meteroid-oss/meteroid 2

Latest meteroid-oss CVEs

Newest publication first

1. CVE-2026-125752 Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

   Published 2026-11-10

   Low·CVSS 2.3 EPSS 0.25%

   Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can suppl...

2. CVE-2026-125751 Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById

   Published 2026-11-10

   Low·CVSS 2.3 EPSS 0.20%

   Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.