Unauthenticated Remote Code Execution in Taskcluster by Mozilla

CVE-2026-55094

What is CVE-2026-55094?

Taskcluster, the task execution framework supporting Mozilla's CI and release processes, is susceptible to unauthenticated remote code execution when deployed with an anonymous role that reveals its GraphQL endpoint. The vulnerability arises from the parsing of filter arguments using the sift library, allowing potential attackers to exploit this weak configuration. This critical vulnerability has been addressed in version 100.3.0, which is now available, urging users to upgrade to secure their deployments.

References