CVE-2026-54713: cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

August 27, 2026

For jobs with shouldBeUnique = true the queue plugin will generate a ‘unique identifier’ based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.

References

github.com/advisories/GHSA-r5pm-vrc5-3m73
github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34
github.com/cakephp/queue/pull/188
github.com/cakephp/queue/releases/tag/2.3.1
github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73
nvd.nist.gov/vuln/detail/CVE-2026-54713

Code Behaviors & Features

Detect and mitigate CVE-2026-54713 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →