Critical Strapi Flaws Enable Unauthenticated Admin Takeover and Server RCE

A pair of critical vulnerabilities in the Strapi headless CMS (CVE-2026-22599 and CVE-2026-27886) allow attackers to inject arbitrary database statements via the Content-Type Builder and to perform an unauthenticated relational-query oracle attack to recover admin reset tokens and take over administrator accounts; fixes and behavioral IOCs have been published and administrators are urged to audit logs and update to patched versions (v5.33.2+ mitigations for the builder and v5.37.0+ for the relational-query fix).