CVE-2026-90446

MediumCVSS 4.3/10Last modified Oct 2, 2026

Description

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 11, 2026
Last modified
Oct 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-904476.5A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-suppliCVE-2026-904486.5A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restrCVE-2026-904496.5When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface CVE-2026-90457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise foCVE-2026-904504.3The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role reCVE-2026-904515.9An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled CVE-2026-904525.3Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify tCVE-2026-904533.5A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without CVE-2026-904544.3A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routCVE-2026-904553.7A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing thCVE-2026-904568.1An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative pasCVE-2026-904576.2The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, a