CVE-2026-45229: Mass Assignment in Quark Drive

The core of this vulnerability lies in Quark Drive's handling of data submitted to the /update endpoint. Attackers can craft malicious POST requests containing arbitrary webui objects targeted at the config_data dictionary. Due to inadequate deny-list filtering, these objects can be used to overwrite stored administrator login credentials. Successful exploitation allows an attacker to permanently replace legitimate credentials, effectively locking out authorized administrators. This grants the attacker persistent access to all configured tasks, cloud tokens, and notification services managed by Quark Drive, potentially leading to widespread compromise and data exfiltration. The impact is significant due to the potential for complete system takeover and long-term persistence.

1. Reserviert2026-05-11
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-45229 is to immediately upgrade Quark Drive to version 0.8.5 or later. If an upgrade is not immediately feasible, consider implementing temporary workarounds. Review and strengthen input validation on the /update endpoint to prevent arbitrary data from being written to the config_data dictionary. Implement stricter access controls to limit who can access and modify the /update endpoint. Consider using a Web Application Firewall (WAF) to filter malicious requests targeting the endpoint. Monitor logs for suspicious POST requests to the /update endpoint, specifically looking for unusual data structures or attempts to modify sensitive configuration parameters.