CVE-2026-40690

MediumCVSS 4.3/10Last modified Nov 3, 2026

Description

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-1220

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-406917.5In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails CVE-2026-406935.7Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of service CVE-2026-406945.8Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged CVE-2026-406956.8Null pointer dereference for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software CVE-2026-406975.8Use after free for some Intel(R) Wireless Software for Windows within Ring 3: User Applications may allow denial of service. Unprivileged so CVE-2026-406988.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrat CVE-2026-406996.5A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to acces CVE-2026-40704.3The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This i CVE-2026-407014.8NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" CVE-2026-407029.4WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can e CVE-2026-407035.4A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions whic CVE-2026-407045.4Protection mechanism failure for some Intel Neural Compressor software before version master within Ring 3: User Applications may allow an e