TarsCloud vulnerabilities
We track 2 vulnerabilities in TarsCloud products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 26, 2026.
2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score
Latest TarsCloud vulnerabilities
- 9.8 Critical severity
TarsWeb: Authentication Bypass by Spoofing
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request
- 8.8 High severity
TarsWeb: Missing Authorization
TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a depl