FKIE_CVE-2026-9831

Vulnerability from fkie_nvd - Published: 2026-05-29 22:16 - Updated: 2026-07-22 06:10
Severity
6.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.
References
1c053176-eef3-4d6a-ae0b-24728c86587bhttps://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "SaaS (Cloud Hosted)"
          ],
          "product": "Extreme Platform ONE",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "lessThan": "25.10.0-104",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.10.0-104",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "1c053176-eef3-4d6a-ae0b-24728c86587b"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."
    },
    {
      "lang": "es",
      "value": "Una condici\u00f3n de carrera en la ruta de autenticaci\u00f3n de clave API compartida del IAM Gateway de Extreme Platform ONE podr\u00eda, bajo condiciones espec\u00edficas de tr\u00e1fico de alta concurrencia, permitir intermitentemente que las solicitudes autenticadas con una clave API emitida por Extreme Platform ONE /IAM reciban datos de respuesta para otro inquilino. El problema se observ\u00f3 a trav\u00e9s de los puntos finales de la API de ExtremeCloud IQ/XIQ y se valid\u00f3 tanto contra las rutas de la API de XIQ/XAPI como las de Extreme Platform ONE /Common Services. Los tokens nativos de XIQ y la autenticaci\u00f3n est\u00e1ndar OAuth/Bearer JWT no se vieron afectados."
    }
  ],
  "id": "CVE-2026-9831",
  "lastModified": "2026-07-22T06:10:00.170",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0,
        "source": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9831",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-01T13:52:52.575235Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-29T22:16:23.980",
  "references": [
    {
      "source": "1c053176-eef3-4d6a-ae0b-24728c86587b",
      "url": "https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851"
    }
  ],
  "sourceIdentifier": "1c053176-eef3-4d6a-ae0b-24728c86587b",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        },
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ],
      "source": "1c053176-eef3-4d6a-ae0b-24728c86587b",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.