Vulnerability-Lookup

CVE-2026-56668 (GCVE-0-2026-56668)

Vulnerability from cvelistv5 – Published: 2026-07-10 17:46 – Updated: 2026-07-14 13:40

Title

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 13:39 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zitadel/zitadel/security/advis…	x_refsource_CONFIRM
https://github.com/zitadel/zitadel/commit/e2886a6…	x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v4.15.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
zitadel	zitadel	Affected: < 4.15.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:39:42.876575Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T13:40:35.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.15.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL\u0027s OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token\u0027s scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T17:46:25.937Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3"
        }
      ],
      "source": {
        "advisory": "GHSA-vrh8-c9cm-wh8v",
        "discovery": "UNKNOWN"
      },
      "title": "ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56668",
    "datePublished": "2026-07-10T17:46:25.937Z",
    "dateReserved": "2026-06-22T16:39:01.043Z",
    "dateUpdated": "2026-07-14T13:40:35.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-56668",
      "date": "2026-09-19",
      "epss": "0.00413",
      "percentile": "0.35227"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "zitadel",
                "vendor": "zitadel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.15.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL\u0027s OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token\u0027s scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3."
          }
        ],
        "id": "CVE-2026-56668",
        "lastModified": "2026-07-14T14:16:35.310",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-56668",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:39:42.876575Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-10T18:16:24.413",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-56668",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-14T13:39:42.876575Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-14T13:40:31.901Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "zitadel",
              "vendor": "zitadel",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.15.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL\u0027s OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token\u0027s scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-10T17:46:25.937Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v"
            },
            {
              "name": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc"
            },
            {
              "name": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3"
            }
          ],
          "source": {
            "advisory": "GHSA-vrh8-c9cm-wh8v",
            "discovery": "UNKNOWN"
          },
          "title": "ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-56668",
        "datePublished": "2026-07-10T17:46:25.937Z",
        "dateReserved": "2026-06-22T16:39:01.043Z",
        "dateUpdated": "2026-07-14T13:40:35.609Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-56668

Vulnerability from fkie_nvd - Published: 2026-07-10 18:16 - Updated: 2026-07-14 14:16

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc
	security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v4.15.3
	security-advisories@github.com	https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.15.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL\u0027s OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token\u0027s scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3."
    }
  ],
  "id": "CVE-2026-56668",
  "lastModified": "2026-07-14T14:16:35.310",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-56668",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-14T13:39:42.876575Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-10T18:16:24.413",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VRH8-C9CM-WH8V

Vulnerability from github – Published: 2026-09-14 21:28 – Updated: 2026-09-14 21:28

Summary

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Details

Summary

A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies configured within ZITADEL.

Impact

ZITADEL enables administrators to restrict token issuance based on client permissions, project roles, and specific scopes. Due to a missing verification step during the Token Exchange flow (urn:ietf:params:oauth:grant-type:token-exchange), ZITADEL fails to validate whether the incoming access token belongs to or is authorized for the client initiating the exchange. Additionally, ZITADEL does not enforce that the newly requested scopes must stay within the boundaries of the original token's scopes.

An attacker with valid access to a low-privilege application can exploit this behavior by sending a token exchange request to a highly-privileged target application. This allows them to obtain administrative project roles, access sensitive profile data, or gain unauthorized access to other applications across the system. If public clients (which do not require client secrets) are used, this risk increases significantly as it requires no client authentication.

Affected Versions

Systems running one of the following versions are affected:

4.x: 4.0.0 through 4.15.2 (including RC versions)
3.x: 3.0.0 through 3.4.12 (including RC versions)

Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing strict audience ownership verification and ensuring that requested scopes during a token exchange are restricted to a subset of the original token’s scopes.

4.x: Upgrade to $\ge$ 4.15.3
3.x: Upgrade to $\ge$ 4.15.3

Workarounds

The recommended solution is to upgrade to a patched version immediately. If an immediate upgrade is not possible, implement one of the following mitigations: - Disable via Feature Flag: Ensure the Token Exchange feature flag is explicitly turned off in your instance settings or environment variables (ZITADEL_DEFAULTINSTANCE_FEATURES_TOKENEXCHANGE=false). If the feature flag is disabled, the endpoint is unreachable and your system is not vulnerable. This is only possible in versions prior to v4.11.0, where the feature was not yet GA. - Remove the Grant Type: Ensure that the Token Exchange grant type is completely disabled or removed from all configured applications—especially high-privilege or public clients.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com.

Credits

Thanks to thesecguy45 and Shubham Raj / Causal Security for reporting this vulnerability.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.15.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56668"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-14T21:28:23Z",
    "nvd_published_at": "2026-07-10T18:16:24Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA vulnerability in ZITADEL\u2019s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies configured within ZITADEL.\n\n### Impact\n\nZITADEL enables administrators to restrict token issuance based on client permissions, project roles, and specific scopes. Due to a missing verification step during the Token Exchange flow (`urn:ietf:params:oauth:grant-type:token-exchange`), ZITADEL fails to validate whether the incoming access token belongs to or is authorized for the client initiating the exchange. Additionally, ZITADEL does not enforce that the newly requested scopes must stay within the boundaries of the original token\u0027s scopes.\n\nAn attacker with valid access to a low-privilege application can exploit this behavior by sending a token exchange request to a highly-privileged target application. This allows them to obtain administrative project roles, access sensitive profile data, or gain unauthorized access to other applications across the system. If public clients (which do not require client secrets) are used, this risk increases significantly as it requires no client authentication.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.15.2` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing strict audience ownership verification and ensuring that requested scopes during a token exchange are restricted to a subset of the original token\u2019s scopes.\n\n* **4.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n* **3.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version immediately. If an immediate upgrade is not possible, implement one of the following mitigations:\n - Disable via Feature Flag: Ensure the Token Exchange feature flag is explicitly turned off in your instance settings or environment variables (`ZITADEL_DEFAULTINSTANCE_FEATURES_TOKENEXCHANGE=false`). If the feature flag is disabled, the endpoint is unreachable and your system is not vulnerable. This is only possible in versions prior to v4.11.0, where the feature was not yet GA.\n- Remove the Grant Type: Ensure that the Token Exchange grant type is completely disabled or removed from all configured applications\u2014especially high-privilege or public clients.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com).\n\n### Credits\n\nThanks to [thesecguy45](https://github.com/thesecguy45) and [Shubham Raj / Causal Security](https://github.com/cipher-creator) for reporting this vulnerability.",
  "id": "GHSA-vrh8-c9cm-wh8v",
  "modified": "2026-09-14T21:28:23Z",
  "published": "2026-09-14T21:28:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56668"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zitadel/zitadel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-56668 (GCVE-0-2026-56668)

FKIE_CVE-2026-56668

GHSA-VRH8-C9CM-WH8V

Summary

Impact

Affected Versions

Patches

Workarounds

Questions

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour