Vulnerability-Lookup

CVE-2026-45720 (GCVE-0-2026-45720)

Vulnerability from cvelistv5 – Published: 2026-09-17 19:40 – Updated: 2026-09-17 20:21

Title

Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

Summary

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 20:21 UTC

CWE

CWE-294 - Authentication Bypass by Capture-replay
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/siderolabs/omni/security/advis…	x_refsource_CONFIRM
https://github.com/siderolabs/omni/pull/2816	x_refsource_MISC
https://github.com/siderolabs/omni/commit/272d3f4…	x_refsource_MISC
https://github.com/siderolabs/omni/commit/4c4c1e2…	x_refsource_MISC
https://github.com/siderolabs/omni/commit/ced79da…	x_refsource_MISC
https://github.com/siderolabs/omni/releases/tag/v1.6.6	x_refsource_MISC
https://github.com/siderolabs/omni/releases/tag/v1.7.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
siderolabs	omni	Affected: < 1.6.6 Affected: >= 1.7.0, < 1.7.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45720",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T20:21:30.412238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T20:21:50.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "omni",
          "vendor": "siderolabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim\u0027s privileges. This issue is fixed in versions 1.6.6 and 1.7.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294: Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T19:40:57.112Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m"
        },
        {
          "name": "https://github.com/siderolabs/omni/pull/2816",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/omni/pull/2816"
        },
        {
          "name": "https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13"
        },
        {
          "name": "https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921"
        },
        {
          "name": "https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a"
        },
        {
          "name": "https://github.com/siderolabs/omni/releases/tag/v1.6.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/omni/releases/tag/v1.6.6"
        },
        {
          "name": "https://github.com/siderolabs/omni/releases/tag/v1.7.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/omni/releases/tag/v1.7.3"
        }
      ],
      "source": {
        "advisory": "GHSA-5x9f-6vg5-qg4m",
        "discovery": "UNKNOWN"
      },
      "title": "Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45720",
    "datePublished": "2026-09-17T19:40:57.112Z",
    "dateReserved": "2026-05-13T05:51:48.666Z",
    "dateUpdated": "2026-09-17T20:21:50.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45720",
      "date": "2026-09-18",
      "epss": "0.00112",
      "percentile": "0.0156"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "omni",
                "vendor": "siderolabs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.6.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.7.0, \u003c 1.7.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim\u0027s privileges. This issue is fixed in versions 1.6.6 and 1.7.3."
          }
        ],
        "id": "CVE-2026-45720",
        "lastModified": "2026-09-17T21:17:12.743",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-45720",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T20:21:30.412238Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-17T20:16:49.190",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/omni/pull/2816"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/omni/releases/tag/v1.6.6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/omni/releases/tag/v1.7.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-294"
              },
              {
                "lang": "en",
                "value": "CWE-367"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-45720

Vulnerability from fkie_nvd - Published: 2026-09-17 20:16 - Updated: 2026-09-17 21:17

Severity

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13
	security-advisories@github.com	https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921
	security-advisories@github.com	https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a
	security-advisories@github.com	https://github.com/siderolabs/omni/pull/2816
	security-advisories@github.com	https://github.com/siderolabs/omni/releases/tag/v1.6.6
	security-advisories@github.com	https://github.com/siderolabs/omni/releases/tag/v1.7.3
	security-advisories@github.com	https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "omni",
          "vendor": "siderolabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim\u0027s privileges. This issue is fixed in versions 1.6.6 and 1.7.3."
    }
  ],
  "id": "CVE-2026-45720",
  "lastModified": "2026-09-17T21:17:12.743",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45720",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T20:21:30.412238Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-17T20:16:49.190",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/pull/2816"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/releases/tag/v1.6.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/releases/tag/v1.7.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        },
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5X9F-6VG5-QG4M

Vulnerability from github – Published: 2026-06-05 15:25 – Updated: 2026-06-05 15:25

Summary

Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token

Details

Summary

SAML.getSession (internal/pkg/auth/interceptor/saml.go) checks the Used flag on a SAMLAssertion resource and then marks it used in two separate state operations. Because the check and the update are not atomic, concurrent requests carrying the same saml-session token can both observe Used == false, both pass validation, and both return a successful authentication context. An attacker who obtains a valid saml-session token can exploit this window to authenticate as the token's owner multiple times, defeating the one-time-use guarantee.

Severity

Attack Vector: Local: the attacker needs to either be able to intercept the local, unencrypted traffic or needs access to user's browser.
Attack Complexity: High: the attacker must first obtain a valid saml-session token belonging to the victim (requires a separate interception step; the token is ephemeral and single-use by design).
Privileges Required: None: no Omni account is required to carry out the race once the session token is in hand.
User Interaction: Required: the victim must initiate a SAML authentication flow to produce the session token that the attacker intercepts.
Scope: Unchanged: the impact stays within Omni's authorization boundary.
Confidentiality Impact: High: successful exploitation authenticates the attacker as the victim's email identity, granting read access to any resource accessible to that identity.
Integrity Impact: High: the attacker can confirm one or more public keys under the victim's identity (via ConfirmPublicKey), establishing persistent access credentials tied to the victim's account.
Availability Impact: High: if the attacker can successfully perform the attack and if the victim is a privileged Omni user, e.g., an Omni Operator or Admin, they can take Omni down.

Impact

Session replay: A stolen saml-session token can be used more than once, defeating its single-use guarantee.
Multiple public key confirmations: An attacker who steals the session can confirm N attacker-controlled public keys under the victim's identity in a single stolen session window, creating N persistent long-lived API credentials tied to the victim's account.
Authentication as victim: Any gRPC endpoint gated by the SAML interceptor can be reached as the victim's email identity during the race window.
Audit log pollution: Each raced call generates an audit entry attributed to the victim's email, obscuring the attacker's actions.

Credit

This vulnerability was discovered and reported by bugbunny.ai.

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siderolabs/omni"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siderolabs/omni"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45720"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294",
      "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T15:25:28Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`SAML.getSession` (`internal/pkg/auth/interceptor/saml.go`) checks the `Used` flag on a `SAMLAssertion` resource and then marks it used in two separate state operations. Because the check and the update are not atomic, concurrent requests carrying the same `saml-session` token can both observe `Used == false`, both pass validation, and both return a successful authentication context. An attacker who obtains a valid `saml-session` token can exploit this window to authenticate as the token\u0027s owner multiple times, defeating the one-time-use guarantee.\n\n## Severity\n\n- **Attack Vector:** Local: the attacker needs to either be able to intercept the local, unencrypted traffic or needs access to user\u0027s browser.\n- **Attack Complexity:** High: the attacker must first obtain a valid `saml-session` token belonging to the victim (requires a separate interception step; the token is ephemeral and single-use by design).\n- **Privileges Required:** None: no Omni account is required to carry out the race once the session token is in hand.\n- **User Interaction:** Required: the victim must initiate a SAML authentication flow to produce the session token that the attacker intercepts.\n- **Scope:** Unchanged: the impact stays within Omni\u0027s authorization boundary.\n- **Confidentiality Impact:** High: successful exploitation authenticates the attacker as the victim\u0027s email identity, granting read access to any resource accessible to that identity.\n- **Integrity Impact:** High: the attacker can confirm one or more public keys under the victim\u0027s identity (via `ConfirmPublicKey`), establishing persistent access credentials tied to the victim\u0027s account.\n- **Availability Impact:** High: if the attacker can successfully perform the attack and if the victim is a privileged Omni user, e.g., an Omni Operator or Admin, they can take Omni down.\n\n## Impact\n\n- **Session replay**: A stolen `saml-session` token can be used more than once, defeating its single-use guarantee.\n- **Multiple public key confirmations**: An attacker who steals the session can confirm N attacker-controlled public keys under the victim\u0027s identity in a single stolen session window, creating N persistent long-lived API credentials tied to the victim\u0027s account.\n- **Authentication as victim**: Any gRPC endpoint gated by the SAML interceptor can be reached as the victim\u0027s email identity during the race window.\n- **Audit log pollution**: Each raced call generates an audit entry attributed to the victim\u0027s email, obscuring the attacker\u0027s actions.\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).",
  "id": "GHSA-5x9f-6vg5-qg4m",
  "modified": "2026-06-05T15:25:28Z",
  "published": "2026-06-05T15:25:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siderolabs/omni"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/omni/releases/tag/v1.6.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/omni/releases/tag/v1.7.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-45720 (GCVE-0-2026-45720)

FKIE_CVE-2026-45720

GHSA-5X9F-6VG5-QG4M

Summary

Severity

Impact

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour