CVE-2026-87108
LowCVSS 3.1Summary
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Risk Assessment
A low-privileged user could access host and configuration information from other projects, potentially leading to data leakage and breach of project isolation. The risk affects organizations using Ops Manager with multiple projects.
Recommendation
Upgrade Ops Manager to a version containing the ownership validation fix. Until patched, restrict read-only roles and monitor access to monitoring records.
Other vulnerabilities in Ops Manager
See all- CVE-2026-87110Medium
An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.
- CVE-2026-87109Medium
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Original NVD description (English source)
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS