---
title: "Security digest: April 29, 2026"
url: https://erroneo.us/security/2026-04-29/
description: "April 29, 2026 vulnerability digest: 1 brief (Copy Fail); 6 critical advisories (Maven, npm, Composer (PHP)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-29
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 29, 2026

1 editorial brief and 6 critical advisories.

## Take stock

- Act now: Copy Fail . Anyone running Linux kernels 4.14+ without the fix where untrusted or semi-trusted code runs: CI/CD runners, Kubernetes and Docker hosts, multi-user and hosting servers.
- Maven: 2 critical advisories ( com.coravy.hudson.plugins.github:github , org.hyperledger.fabric-sdk-java:fabric-sdk-java ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 2 critical advisories ( n8n ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 2 critical advisories ( phpoffice/phpspreadsheet , cockpit-hq/cockpit ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Copy Fail: Exploited Linux Kernel Root Exploit Since 2017](https://erroneo.us/security/briefs/copy-fail-linux-kernel-lpe-cve-2026-31431/index.md): Any Linux box that runs code from more than one trust level (CI runners, container hosts, shared servers) needs a patched kernel and reboot now; single-user machines can patch on a short cycle.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-42523](https://erroneo.us/security/cve/CVE-2026-42523/index.md) Jenkins GitHub Plugin has an XSS vulnerability — Maven com.coravy.hudson.plugins.github:github < 1.46.0.1 → 1.46.0.1
- [CVE-2026-42231](https://erroneo.us/security/cve/CVE-2026-42231/index.md) n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE — npm n8n < 1.123.32 → 1.123.32; npm n8n >= 2.18.0, < 2.18.1 → 2.18.1; npm n8n >= 2.17.0, < 2.17.4 → 2.17.4
- [CVE-2026-34084](https://erroneo.us/security/cve/CVE-2026-34084/index.md) PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled — Composer (PHP) phpoffice/phpspreadsheet >= 4.0.0, <= 5.5.0 → 5.6.0; Composer (PHP) phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.3 → 3.10.4; Composer (PHP) phpoffice/phpspreadsheet >= 2.2.0, <= 2.4.3 → 2.4.4
- [CVE-2026-41586](https://erroneo.us/security/cve/CVE-2026-41586/index.md) fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE — Maven org.hyperledger.fabric-sdk-java:fabric-sdk-java >= 1.0.0, <= 2.2.26 → no fix
- [CVE-2026-42232](https://erroneo.us/security/cve/CVE-2026-42232/index.md) n8n has XML Node Prototype Pollution that to RCE — npm n8n >= 2.18.0, < 2.18.1 → 2.18.1; npm n8n >= 2.17.0, < 2.17.4 → 2.17.4; npm n8n < 1.123.32 → 1.123.32
- [CVE-2026-38992](https://erroneo.us/security/cve/CVE-2026-38992/index.md) Cockpit is vulnerable to arbitrary code execution — Composer (PHP) cockpit-hq/cockpit < 2.14.0 → 2.14.0

---
Source page: https://erroneo.us/security/2026-04-29/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt