CVE-2026-90454

MediumCVSS 4.3/10Last modified Oct 2, 2026

Description

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Oct 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-904553.7A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing th CVE-2026-904568.1An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative pas CVE-2026-904576.2The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, a CVE-2026-904585.4OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.CVE-2026-90467.0A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclus CVE-2026-904607.6An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, applicat CVE-2026-904616.3OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) B CVE-2026-904625.4A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-ope CVE-2026-904634.0A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted servic CVE-2026-904666.5Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix ma CVE-2026-904674.0aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into M CVE-2026-90477.6Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with kn