CVE-2026-120829
Ansible
Reported to Red Hat Product Security, which assigned the CVE and credited me with the discovery.
Upstream fix in progress. Technical details will follow the public advisory.
Blue team and cloud security, systems and infrastructure engineering
Cyber Security & Privacy student at H-BRS in Bonn, Germany. I build small, explainable security tools and send fixes upstream to the projects I use, among them Trivy, Prowler, pyinfra and ansible-lint. Red Hat Product Security credited me with discovering CVE-2026-120829 in Ansible.
Security tooling, cloud logs, IOC workflows, and static-first web systems.
$ whoami
haitao.zheng / tao
$ focus --area
cloud-security / blue-team / systems
$ builds --selected
01 cloudtrail-quickscan
02 jsonl-lens
03 socket-state-triage
04 sentinel-ioc-toolkit
05 heartbleed-lab
$ upstream --merged
34 PRs / 7 projects / 2026-11-03
$ disclosures
CVE-2026-120829 / Ansible Fixes I needed in tools I use, sent upstream and merged after review.
Ansible
Reported to Red Hat Product Security, which assigned the CVE and credited me with the discovery.
Upstream fix in progress. Technical details will follow the public advisory.
Merged intoPRsStars
Merged per month Jul–Nov 2026
A year on GitHubNov 2, 2025 – Nov 3, 2026
529 public contributions 109 active days busiest Oct 2, 2026 (35)
Amazon Web Services (AWS), 11 merged
Validate CloudFormation lifecycle policies.
Merged September 2026 · policy and intrinsic-function tests
Merged patch #4704Infrastructure / SSH, 16 merged
Support OpenSSH host certificates.
Merged September 2026 · connector regression tests
Merged patch #1945Kubernetes / Security checks, 3 merged
Report Pods using hostPath volumes.
Merged July 2026 · service collection and check tests
Merged patch #11837Command-line tools for log and host review, and a Heartbleed lab from a course project.
Cloud investigation
An explainable first pass over AWS audit logs: IAM changes, logging disruption, public exposure and unusual activity.
Data inspection
A quick inspection tool for messy event exports: missing fields, type changes, nested paths and noisy identifiers.
Linux socket review
A dependency-free utility for reviewing Linux socket state, wildcard listeners and broad privileged-port bindings.
Indicator extraction
Extracts and normalizes indicators from investigation text, including defanged URLs, domains, hashes and CVE identifiers.
Vulnerability reproduction
A repeatable lab that reproduces CVE-2014-0160 against a vulnerable and a patched OpenSSL side by side, for a course project at H-BRS.
Notes from my projects, open-source fixes and study.
Selected
Latest
University of Applied Sciences, Germany
B.Sc. Cyber Security & Privacy
Bielefeld, Germany
University Preparation & FSP
Online course
Computer Science Foundations
Xiamen, China
High School Diploma
Tools and languages used in the work above.
Linux, networking coursework and SSH connector fixes in pyinfra.
AWS audit-log review, CloudFormation validation and Kubernetes security checks through local tools and upstream contributions.
License detection in Trivy's JAR parser and safer finding links in GuardDog's package scanner.
Python parsers, Java access-log review, C socket inspection and TypeScript application rules.
GitHub Actions and GitHub Pages for this site; Worker APIs and SQL persistence in StudyPulse.
Notes on specific fixes, test cases and implementation limits, linked to the code and review.
A focused tool with readable output and tests comes before anything bigger.
Each project gets a note, so the reasoning is visible and not only the final code.
Check what should be rejected as well as what should pass, and say what the evidence does not prove.
Languages
Personal interests
Questions about a project, a pull request or an opportunity: email reaches me directly. I work in English and German.
↑↓ to move ↵ to open ⌘K or / anywhere