CVE-2026-90454

MediumCVSS 4.3

Published: 11/09/2026(UTC)Updated: 02/10/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records. The proxy configuration otherwise permits the request method those routes use.

Risk Assessment

An authenticated user on a deployment intended to be read-only can add or remove tags on stored session records. This breaches the integrity of analytical data and may lead to incorrect conclusions.

Recommendation

Update the software to a version fixing the route-blocking pattern or restrict the request method at the proxy level. Verify the integrity of tags in stored session records.

Other vulnerabilities in Packet-analysis component

CVE-2026-90451Medium
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default.

Original NVD description (English source)

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS