---
title: "Security digest: June 17, 2026"
url: https://erroneo.us/security/2026-06-17/
description: "June 17, 2026 vulnerability digest: 6 critical advisories (PyPI, Maven, RubyGems). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-17
date_modified: 2026-06-17
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 17, 2026

6 critical advisories.

## Take stock

- Maven: 3 critical advisories ( org.apache.dolphinscheduler:dolphinscheduler-api , ca.uhn.hapi.fhir:org.hl7.fhir.utilities ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 2 critical advisories ( langflow , apache-airflow-providers-sftp ). Check with pip-audit (or: pip show <package>) .
- RubyGems: 1 critical advisory ( avo ). Check with bundle audit check --update .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-55450](https://erroneo.us/security/cve/CVE-2026-55450/index.md) Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak — PyPI langflow < 1.9.1 → 1.9.1
- [CVE-2026-32966](https://erroneo.us/security/cve/CVE-2026-32966/index.md) Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure — Maven org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2 → 3.4.2
- [CVE-2026-50203](https://erroneo.us/security/cve/CVE-2026-50203/index.md) Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory — PyPI apache-airflow-providers-sftp < 5.8.1 → 5.8.1
- [CVE-2026-55518](https://erroneo.us/security/cve/CVE-2026-55518/index.md) Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation — RubyGems avo <= 3.32.0 → 3.32.1; RubyGems avo >= 4.0.0.beta.1, < 4.0.0.beta.51 → 4.0.0.beta.51
- [CVE-2026-32967](https://erroneo.us/security/cve/CVE-2026-32967/index.md) Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks — Maven org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2 → 3.4.2
- [CVE-2026-55471](https://erroneo.us/security/cve/CVE-2026-55471/index.md) HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory — Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities <= 6.9.9 → 6.9.10

---
Source page: https://erroneo.us/security/2026-06-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt