LLM-fabricated CVE advisory wave (programmervuln/cveadvisory-)

The CVE record failed as an index of what to patch in both directions this week — two national CERTs withdrew advisories built on CVEs an LLM invented, while three exploited or CVSS-10 flaws had no CVE at all and one vendor issued one CVE per bug class

A prior weekly recorded that the two standard prioritisation feeds failed together — an exploited flaw absent from CISA's catalogue, and critical flaws with no patch to apply. This week the failure moved one layer down, to the identifier those feeds are keyed on. Six unrelated disclosures in 2026-W32 show the CVE record failing as an index of what to patch, and failing in both directions at once.

In the false-positive direction, two national authorities retracted published advisories. NCSC-NL revised advisory NCSC-2026-0268 on 3 August to state plainly that its SQLite CVE "is door een LLM gehallucineerd" (NCSC-NL, 2026-08-03), and BSI CERT-Bund retitled two SQLite advisories to "MELDUNG ZURÜCKGEZOGEN" (BSI CERT-Bund, 2026-08-03). The originating work is JFrog's reproduction audit, which found that of 55 advisories published through one GitHub account, "54 were completely fabricated, while one contained a real bug wrapped in unverified CVE metadata" — the SQLite entries naming functions absent from the claimed version, citing line numbers past end-of-file, and shipping proofs-of-concept that produce no crash (JFrog Security Research, 2026-07-30). JFrog's structural diagnosis is the part that outlives this batch: "because no step in today's system actually requires a proof-of-concept or bug reproduction, a plausible-sounding fake advisory can slide right through the pipeline and end up in GHSA, downstream databases, and enterprise scanners." Retraction propagated unevenly — GitHub's advisory database was still carrying one of the withdrawn records when this pipeline checked on 4 August.

In the false-negative direction, four flaws that a defender must act on carry no identifier to act on. Metabase disclosed that "Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above," an unauthenticated SQL injection yielding administrator access from which stored credentials for every connected database can be taken (Metabase, 2026-08-06). Two customers, the laptop maker Framework and the form builder Tally, have confirmed that data was taken from their instances on 3 August (BleepingComputer, 2026-08-07). No CVE was assigned, so a purely CVE-driven patch process never surfaces it at all. WALLIX published an authentication bypass in the Bastion REST API rated CVSS 4.0 base 10.0 that hands a remote unauthenticated caller full administrative control of the privileged-access appliance — its credential vault and session recordings included — under the vendor advisory reference WSA-2026-07-0001 rather than a CVE (WALLIX, 2026-07-20); CERT-FR relayed it to its constituency carrying the same absence of an identifier (CERT-FR, 2026-08-06). Traefik's three tenant-isolation advisories, one of which lets a Kubernetes namespace silently take over another's routes, state that no CVE identifiers were assigned (Traefik Labs, 2026-08-03), and Check Point's five workerd sandbox-escape findings were disclosed without CVEs (Check Point Research, 2026-08-06).

Two further cases break the assumption that one CVE describes one flaw with one fix. Cisco's August IOS XE hardening release grouped internally found bugs by weakness class and assigned one CVE per class, stating that "the CVSS score that is assigned to each CVE ID represents the maximum potential severity of the single most impactful underlying bug within that specific CWE category" (Cisco PSIRT, 2026-08-05) — so no individual flaw can be assessed and the only triage unit left is the release. At the other extreme, InfoGuard Labs published 22 CVEs against Tobit TeamDavid, a DACH-region collaboration suite the researchers put at roughly 12,000 publicly accessible instances, bounded at "Rollout 524" with no fixed release named; the researchers' own remediation guidance is "update to newest version, we don't exactly know which vulnerabilities are fixed and which are not," and they report that both they and the national cyber security centre coordinating the disclosure "had been ghosted by the manufacturer" (InfoGuard Labs, 2026-08-07).

This pipeline is not a bystander to the pattern and published two corrections of its own in the same week: a July weekly entry claimed that ten CVEs across four product classes were "every one KEV-listed" when two of them — the Progress ShareFile chain CVE-2026-2699 and CVE-2026-2701 — never were, and a 5 August entry told readers there was no vendor fix for the Thermo Fisher genetic-analyzer integrity flaw when its own cited advisory named patched versions for five product lines. Both errors were produced by treating a catalogue entry or an advisory summary as the fact rather than reading the record itself.

Builds on: 2026-08-04/bsi-ncsc-nl-withdraw-sqlite-advisories-llm-fabricated-cves · 2026-08-09/metabase-unauth-sqli-zeroday-exploited-framework-tally · 2026-08-09/wallix-bastion-rest-api-unauth-admin-cvss10 · 2026-08-05/traefik-kubernetes-multi-tenancy-route-identity-collision · 2026-08-08/cloudflare-workerd-glue-memory-corruption-sandbox-escape · 2026-08-08/cisco-ios-xe-august-2026-hardening-release-cwe-grouped-cves · 2026-08-09/teamdavid-tobit-22-cves-unauth-mailbox-takeover-dach · 2026-08-09/sharefile-cve-2026-2699-2701-never-kev-listed · 2026-08-09/thermo-fisher-genetic-analyzer-correction-patch-exists

BSI and NCSC-NL withdraw SQLite advisories built on LLM-fabricated CVEs — and GitHub's advisory database was still serving one of them

Two European national CERTs pulled published SQLite advisories on 2026-08-03 for the same reason: the vulnerabilities are not real. NCSC-NL revised NCSC-2026-0268 to version 1.01, struck through its own description, and gave the reason in one line — "CVE is door een LLM gehallucineerd" ("the CVE was hallucinated by an LLM") — noting the retracted advisory had covered CVE-2026-51302 as affecting Red Hat's SQLite (NCSC-NL, 2026-08-03). BSI CERT-Bund retitled WID-SEC-2026-2604 and WID-SEC-2026-2581 to "MELDUNG ZURÜCKGEZOGEN" ("advisory withdrawn") and removed their CVE references (BSI CERT-Bund, 2026-08-03; BSI CERT-Bund, 2026-08-03).

The underlying work is a reproduction audit rather than an opinion. JFrog cloned sqlite/sqlite at the claimed tags, compiled the official releases in isolated containers, and fed each advisory's proof-of-concept SQL verbatim into the binaries under AddressSanitizer. Nothing reproduced, and the code references dissolve on inspection: CVE-2026-51302's claimed use-after-free runs through exprComputeOperands(), a function that did not exist in SQLite 3.41 and was added mid-2025, while the function it says does the freeing, sqlite3ReleaseTempReg(), only recycles register indices into an array and performs no heap deallocation at all. CVE-2026-51303 claims a fix in 3.51.3, but "a diff between 3.51.2 and 3.51.3 shows absolutely no changes to src/expr.c". CVE-2026-51296 cites lines 3555 and 3575 of src/json.c when, JFrog notes, "In version 3.41.0, src/json.c is only 2706 lines long". CVE-2026-51297 references jsonBlobEdit(), absent from the claimed release; CVE-2026-51304 gives a single-argument signature for a function that requires a database handle; CVE-2026-51300 cites a comment and a memory allocation as the vulnerable lines (JFrog Security Research, 2026-07-30). SQLite's maintainer reported the same wave independently on 2026-07-29 (SQLite User Forum, 2026-07-29).

The propagation path is the part that matters operationally, because every hop in it is one a defender's own tooling trusts. A newly created GitHub repository published the advisories; MITRE's public submission form performs no identity verification; NVD flagged them critical and CISA's Authorized Data Publisher enrichment agreed; Red Hat initially scored CVE-2026-51302 at 10.0 before downgrading it to 7.6; from there the records reached GHSA and the two national-CERT advisory streams that European public-sector vulnerability management actually reads. JFrog's diagnosis is structural: "Because no step in today's system actually requires a proof-of-concept or bug reproduction, a plausible-sounding fake advisory can slide right through the pipeline and end up in GHSA, downstream databases, and enterprise scanners." Retraction does not travel the same path in reverse — this run fetched GHSA-4r76-5xh9-qj36 — a use-after-free claim against SQLite 3.41 carrying CVE-2026-51294, from the same batch but not among the six JFrog reproduction-tested — and found it still live and marked "Unreviewed" on 2026-08-04, after both CERTs had withdrawn (GitHub Advisory Database, 2026-07-30).