Santosh Kumar Puppala
Independent security researcher
My reports have led to fixes in software used by libraries, universities, court-records sites, health programmes and businesses. Norviq, my open-source runtime policy engine for AI agents, is built and shipped.
Counted from the records listed on this page. Some advisories also have a CVE record, so those two counts overlap.
Scanners match known patterns. The flaws that do real damage are often in the logic: code that runs, passes its tests, and still does the wrong thing.
A security control can be in place and still never fire. A quiet failure like that looks fine in review.
AI agents add to it: every tool call an agent makes is another action that needs a security decision.
Runtime policy enforcement for AI agents
Built and shipped. In active development.
Decides each tool call an LLM agent sends through the Norviq SDK or sidecar, and each call to an MCP server behind its MCP proxy, on Kubernetes. Each call is allowed, blocked, escalated or audited with OPA/Rego policy bound to workload identity.
Authorization regression testing for CI
Early alpha. No release has been tagged yet.
Declare what each identity may do. Veridor issues the same request as every identity, compares the result against the declaration, and fails the build when the answer changes. It turns the comparison method behind my research into a test.
I find security flaws in open-source software and report them to the people who maintain it. Most are logic flaws that scanners miss: the code runs and passes its tests, but does not do what its authors meant.
My method is to compare parts of an application that should behave the same way. When one of them checks less than the others, that one needs an explanation. I published the method as an open-access preprint, and I'm building it into two tools: Norviq, open source, which enforces policy on AI agents' tool calls at runtime, and Veridor, in early alpha, which tests authorization in CI.
The method, in full: Asymmetric Authorization: Finding Access-Control Defects by Comparing Sibling Operations in Open-Source Web Applicationsdoi:10.5281/zenodo.23298712
Step 1 of 6
Line up the parts of an application that should behave the same way and compare their checks. When one checks less than the others, it becomes a candidate.
Step 2 of 6
Test the candidate on my own machine, with made-up accounts and data, and with a control that shows the test can fail.
Step 3 of 6
Report it privately to the maintainers, with the reproduction, through the project's own security channel.
Step 4 of 6
The maintainers ship the fix in their own release.
51published advisories credit me
Step 5 of 6
The advisory and the CVE record go public after the fix ships.
16CVE records
Step 6 of 6
Turn the lesson into tools: Veridor tests authorization in CI, and Norviq enforces policy on AI agents' tool calls at runtime.
Every CVE record, advisory and merged fix, each linked to its public source. Most recent advisory: November 9, 2026.
Six findings in plain words, highest-rated first. Severity and score (CVSS, out of 10) are as published in each advisory.
Found that a malicious web page could run commands on the archiving servers that run Harvard Library Innovation Lab's Scoop, which Perma.cc builds on. Harvard fixed it by removing shell command construction entirely.
Courts, libraries, universities and public healthFound, with a co-finder, that a member of one project on the OpenFn platform could read and change another project's run history and data. The maintainers fixed it, so every request is now checked against its own project.
Public servicesFound that the "deny all" lockdown setting in rosbridge_suite, a robotics bridge imported by a NASA repository, silently allowed full access. The maintainers fixed it across four release lines.
Communications, energy and devicesFound that an ordinary member could make themselves administrator of a library repository run on Hyku. The maintainers fixed it.
Courts, libraries, universities and public healthFound that a user of CourtListener, the free public court-records site, could plant code that ran in the browser of anyone who opened a tampered court-data chart. Free Law Project made that interface read-only and now encodes the data safely.
Courts, libraries, universities and public healthFound that the TANF data system let anyone who knew a staff member's Login.gov ID lock out, delete or change that person's account without logging in. The maintainers fixed it, protecting the state, tribal and territory staff who report TANF welfare data to HHS.
Public servicesFound that Head Start staff in one region could read other regions' grant-recipient records, including recipient identities and staff names. HHS deployed the fix to production on August 28, 2026; out-of-region requests are now refused.
Found that a community-helper account in CiviForm, a benefits-application platform, could look up the name and email of any applicant in the system. The maintainers fixed it, so helpers now see only the applicants in their own group.
Found that any logged-in user of the OpenCRVS civil-registration system could take over a pending account, including a national administrator's, and lock the real user out. The maintainers fixed it.
Found that anonymous visitors could read private and unpublished transcripts in Avalon, used by universities including Indiana University. The maintainers fixed it.
Found that one community-health programme on a shared CommCare HQ server could delete another programme's mobile health workers and data tables. Dimagi fixed it, so deletions are now limited to each programme's own data.
Found that any user of a shared MailWatch email-filtering server could release another organisation's quarantined malware or phishing into its inbox, or delete its mail. The maintainers fixed it.
Found that one crafted text message from an outsider could run commands on gammu SMS-gateway servers in affected configurations. The maintainers fixed it.
Nine fixes I wrote myself were merged into projects I don't own, including Keycloak and NOAA Fisheries' Stock Synthesis model.
OWASP's AI Security Verification Standard merged a change citing my observation by name (PR #1127, September 5, 2026).
13 organisations changed their own code, designs or guidance and named me in the change, including ICIJ, Apache Arrow and the OpenSSF vulnerability guide.
16 published records. 6 name me in the record's credits; the other 10 were issued by GitHub, which credits me on the linked advisory. CVE-2026-104412 and CVE-2026-105678 are two records for the same Ghost flaw, so the 16 records cover 15 distinct issues.
| Record | Project | Issued by | Credit | Published |
|---|---|---|---|---|
| CVE-2026-75520 | Domoticz | Issued by GitHub | credited on the advisory | |
| CVE-2026-82411 | Objects API (Maykin Media) | Issued by GitHub | credited on the advisory | |
| CVE-2026-85749 | MailWatch | Issued by GitHub | credited on the advisory | |
| CVE-2026-113668 | ApostropheCMS | Issued by GitHub | credited on the advisory | |
| CVE-2026-109659 | Frappe ERPNext | Issued by VulnCheck | reporter, with a co-reporter | |
| CVE-2026-107856 | CiviForm | Issued by GitHub | credited on the advisory | |
| CVE-2026-105678 | Ghost, same flaw as CVE-2026-104412 | Issued by GitHub | credited on the advisory | |
| CVE-2026-104412 | Ghost | Issued by VulnCheck | reporter, with a co-reporter | |
| CVE-2026-55610 | InvoiceShelf | Issued by GitHub | credited on the advisory | |
| CVE-2026-61746 | InvenTree | Issued by GitHub | credited on the advisory | |
| CVE-2026-88890 | OpenPanel | Issued by VulnCheck | finder | |
| CVE-2026-84470 | Red Hat Ansible Automation Platform / AWX | Issued by Red Hat | reporter | |
| CVE-2026-54732 | libreoffice-convert | Issued by GitHub | credited on the advisory | |
| CVE-2026-19182 | OpenNMS Meridian and Horizon | Issued by OpenNMS | finder | |
| CVE-2026-73245 | Kestra | Issued by GitHub | credited on the advisory | |
| CVE-2026-16454 | Eclipse hawkBit | Issued by Eclipse Foundation | finder |
51 advisories, published by each project's maintainers, credit me. Titles are the maintainers' own, shortened where long. Shared credit means another researcher is credited too.
Select a severity or a sector to filter the 51 advisories below.
51 advisories
OS command injection through capture URLs and page content in Scoop
Cross-project data access: an authorised user could read and modify another project's data by supplying…
params_glob="[]" deny-all hardening control fails open, allowing full parameter access
XXE in the science-metadata XML parser: the schema/no-namespace/EML branches resolve external entities…
Missing authorization on the group-membership / group-role controllers (privilege escalation to tenant admin)
Unscoped visualization JSONVersion create (IDOR) chained to stored XSS in the public embed view
Cross-company user read/update IDOR enables cross-tenant account takeover
ORM relational-filter injection in asset-search q= leaks another user's API token
ClickHouse SQL injection via unvalidated profile.* filter column identifier
REST API ignores item-level restrictions enforced on the web path…
IDOR lets any authenticated user release or delete any other tenant's quarantined mail
Improper Neutralization of Special Elements used in an OS Command in Gammu
Unauthenticated DELETE of any RDM controlled-vocabulary Value in Arches (/conceptvalue/)
Missing write authorization on /api/apply lets read-only users commit to branches
Missing ownership check in activate procedure allows account takeover
In-realm vertical privilege escalation via unguarded credential operations (manage_users → manage_realm)
Cross-vendor inventory-level write/delete via the top-level location-levels/batch route…
Cross-project user IDOR: single-user route looks up users by id with the project filter commented out
Two child tables ship with a write grant but no Row-Level-Security policy…
Resource-instance permission bypass on POST /api/tiles/{tileid}…
Cross-enterprise authorization flaw in the v1 customer_account_transaction API
Invitation path grants org roles without manage-roles, allowing a manage-invitations holder to escalate to…
Specific REST APIs fail to enforce cross-domain validation on ID references (IDOR)
Missing Authorization in Plan Contributors Endpoint May Expose Contributor Metadata
Missing organization-scope authorization on data-entry write routes
Import bypasses collection-level RBAC and reads Milvus internal storage
Cross-region recipient-goals IDOR (missing region-scope check on GET /api/recipient/:id/goals)
Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Cross-object-type authorization bypass on object history-detail endpoint (Objects API): IDOR
Customer update authorizes on the record's current enterprise_id while permitting enterprise_id as a…
UDM REST API license import authorization bypass with delegative administration enabled
Missing authorization on the Assign-Class-Instructors GWT-RPC load/save path
Missing authorization on the udevices command handler lets a low-privilege user invoke Lua parser scripts…
:_id/locales REST route omits the public-API authorization gate its sibling read routes enforce…
Unauthenticated disclosure of pre-publication (draft/expired) Forest Operations Map metadata and spatial…
Unauthenticated raw meter-readings export (missing server-side authorization)
Plugin-settings GET endpoints are readable without authentication
Web Apps form sessions can be read, altered and destroyed across project spaces (IDOR)
Trusted-Intermediary IDOR discloses any citizen's name and email
RBAC fail-open on ListEnvironments/ListNamespaces: a zero-access identity receives the full unfiltered list
Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
No advisories match these filters.
Code I wrote for projects I don't own, reviewed and merged by their maintainers.
| Project | Change | Merged |
|---|---|---|
| Community Terrestrial Systems Model | Fix quoting in check-compset-aliases.sh and paths in check-testlists.ymlESCOMP/CTSM#4247 | |
| Keycloak | Only apply a resource-type deny to the scopes it coverskeycloak/keycloak#53313 | |
| QCSchema Validator | Fixed type check always passing for symbols and geometryrmrresearch/QCSChema-Validator#6 | |
| Embabel | Record a returned Tool.Result.Error as a failed ToolCallResponseEventembabel/embabel-agent#2068 | |
| Stock Synthesis (NOAA Fisheries) | Count warnings rather than source-context lines in the warnings gatenmfs-ost/ss3-source-code#787 | |
| Community Terrestrial Systems Model | Make the Python unit-test job fail when a test failsESCOMP/CTSM#4236 | |
| F Prime baremetal package | Move format check into .github/workflows and fix its pip cachefprime-community/fprime-baremetal#55 | |
| Lelu | Complete the confusables table and fold before the fuzzy matchLelu-ai/lelu#59 | |
| ChirpStack | Require gateway-admin for relay-gateway update/deletechirpstack/chirpstack#982 |
Preprint · Zenodo
October 11, 2026
Preprint · Zenodo
October 12, 2026
CarolinaCon 2026 (virtual)
Slides: doi:10.5281/zenodo.23478945
OWASP AppSec Days India 2026 (virtual)Scheduled
Newsletter
A newsletter on security flaws is coming: one bug per issue, told from the first lead to the fix, after each one is fixed and public.
Before research, I built and secured cloud and AI platforms for a bank, a financial-services firm and Lenovo, where I work today.
Lenovo United States Inc., Morrisville, North Carolina
Security and platform engineering for AI applications: identity at every layer, least privilege, and release gates that test authorization.
Lenovo United States Inc., Morrisville, North Carolina
Edge and web-application security for Lenovo's public domains, and the security of eight production Azure Kubernetes Service clusters.
Origin Hubs, Inc., consultant to a financial-services client
Kubernetes platform security on Red Hat OpenShift: admission policy, secrets management, mutual TLS and access control.
Origin Hubs, Inc., consultant to a banking client
Least-privilege cloud access on AWS and Azure, secrets out of servers, and hardened infrastructure as code.
Villanova University
Villanova University
Villanova University
Conferred December 31, 2021
Wilmington University
Conferred December 17, 2018. Dean's List, Spring 2016, Summer 2016, Spring 2017