CVE-2026-41104

{**Immediate action:** Configure the API gateway to require authentication and restrict `/api/compute` and `/api/jobs` to known clients only. ```yaml # planetary-config.yaml api: authentication: required: true allowAnonymous: false endpoints: - path: /api/compute allowedOrigins: ["trusted-client.internal"] - path: /api/jobs allowedOrigins: ["trusted-client.internal"] ``` Apply via `kubectl apply -f planetary-config.yaml` or equivalent config management. **Verification:** Test that anonymous POST requests return `401 Unauthorized`. **Rollback:** Set `allowAnonymous: true` if legitimate workflows break, but prioritize patching to 2.6.2 within 24–48 hours. **Note:** This does *not* fix the vuln, only reduces attack surface. Authenticated users can still trigger deserialization.}