GHSA-F989-C77F-R2CQ

Between September 3 and September 10, 2021 a flaw in Travis CI's build activation process, tracked as CVE-2021-41077 and disclosed publicly on September 13, caused secure environment variables to be injected into builds they should never reach. Secret data normally restricted to the private context of a repository was unexpectedly shared with builds triggered by pull requests from forks of public repositories, contradicting the customer's .travis.yml configuration. As a result anyone could fork a public project, open a pull request, and simply print the build environment to read the upstream project's secret environment variables, exposing signing keys, access credentials, and API tokens across thousands of open-source projects. This was a secret-exfiltration-to-forked-builds class flaw; Ethereum's Felix Lange flagged it on September 7 and Travis CI silently patched it on September 10 with no initial post-mortem, prompting affected projects such as conda-forge to rotate roughly 70 feedstock tokens.

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently

Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)

BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets