---
title: "Security digest: August 20, 2026"
url: https://erroneo.us/security/2026-08-20/
description: "August 20, 2026 vulnerability digest: 2 briefs (Spring for GraphQL CVE-2026-59285: Pagination…); 2 CISA KEV additions (TrueConf); 2 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-20
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 20, 2026

2 editorial briefs, 2 known exploited (cisa kev) additions and 2 critical advisories.

## Take stock

- Check exposure: Spring for GraphQL CVE-2026-59285: Pagination RCE Risk . Teams running Spring for GraphQL 2.0.0 through 2.0.4 (Spring Boot 4.0.x before 4.0.8, or 4.1.0) with Jackson 2.x JSON handling and at least one paginated (Connection) field.
- Check exposure: arrayref, internment, append-only-vec: Rust Crates Hijacked . Rust developers and CI pipelines that ran cargo update, cargo add, or an unlocked build that pulled arrayref, internment or append-only-vec between about 07:11 and 09:25 UTC on August 20, 2026.
- Do you run any of these? TrueConf Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-23.
- npm: 1 critical advisory ( @whyour/qinglong ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/dgraph-io/dgraph/v25 ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Spring for GraphQL CVE-2026-59285: Pagination RCE Risk](https://erroneo.us/security/briefs/spring-for-graphql-cve-2026-59285-deserialization/index.md): Only Spring Boot 4 apps on Spring for GraphQL 2.0.0-2.0.4 that use Jackson 2.x and expose paginated Connection fields are at risk; if that is you, take the 2.0.5 upgrade now.
- **Check exposure** [arrayref, internment, append-only-vec: Rust Crates Hijacked](https://erroneo.us/security/briefs/arrayref-crates-io-proc-macro1-build-script-malware/index.md): Only builds that resolved the three poisoned releases during a roughly two-hour window on August 20, 2026 ran the payload, but any machine that did should be treated as compromised.

## Known exploited (CISA KEV)

- [CVE-2026-72530](https://erroneo.us/security/cve/CVE-2026-72530/index.md) TrueConf Server: TrueConf Server Code Injection Vulnerability (CISA due 2026-09-03)
- [CVE-2026-72529](https://erroneo.us/security/cve/CVE-2026-72529/index.md) TrueConf Server: TrueConf Server Missing Authentication for Critical Function Vulnerability (CISA due 2026-08-23)

## Critical advisories

- [CVE-2026-55445](https://erroneo.us/security/cve/CVE-2026-55445/index.md) Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication — npm @whyour/qinglong < 2.20.1 → 2.20.1
- [CVE-2026-54061](https://erroneo.us/security/cve/CVE-2026-54061/index.md) Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import — Go github.com/dgraph-io/dgraph/v25 <= 25.3.4 → 25.3.5

---
Source page: https://erroneo.us/security/2026-08-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt