CVE-2026-90451
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default.
Risk Assessment
An attacker aware of the default secret can forge valid authentication cookies for that component and gain unauthorized access. The risk applies to any deployment where the secret regeneration step was skipped.
Recommendation
Do not copy the example configuration file directly into production — always run the setup routine that regenerates the secret. Verify existing deployments for use of the default value and rotate it if necessary.
Other vulnerabilities in Packet-analysis component
Original NVD description (English source)
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS