CVE-2026-127279
Deferred Deferred - Pending Action

Authentication Bypass in AIP-PUB ACPs-Community

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulDB

Description
A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127279
EUVD
EUVD-2026-124815

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
AIP-PUB ACPs-community 2.0
AIP-PUB ACPs-community 2.1
AIP-PUB ACPs-community 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127279 is a vulnerability in AIP-PUB ACPs-community up to version 2.2.0 where the discovery-server component exposes an unauthenticated management API on port 9005. This allows remote attackers to access sensitive endpoints like /admin/dsp/* and /admin/alive-sync/* without authentication.

Detection Guidance

Check if port 9005 is open and accessible on your network. Use commands like 'netstat -tulnp | grep 9005' or 'ss -tulnp | grep 9005' to verify if the discovery-server is listening on this port. Additionally, test access to endpoints like /admin/dsp/* and /admin/alive-sync/* using curl commands such as 'curl -v http://<target-ip>:9005/admin/dsp/status'.

If these endpoints respond without requiring authentication, the system is likely vulnerable. Monitor logs for unauthorized access attempts or unusual activity on port 9005.

Impact Analysis

This vulnerability enables attackers to perform destructive actions such as deleting all agent data via hard-reset, stopping synchronization services, forcing expensive full-sync cycles, or disclosing internal registry connection details. The exploit is public and can be launched remotely.

Compliance Impact

The vulnerability allows unauthenticated access to sensitive administrative endpoints, which could lead to unauthorized data deletion, service disruption, or exposure of internal registry details. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to personal or sensitive data and disrupting critical services.

Mitigation Strategies

Immediately restrict access to port 9005 by configuring a firewall to allow only trusted IPs. Disable or remove the exposed management endpoints if possible. Update to a patched version once authentication and authorization improvements are released by the vendor.

If immediate patching is not possible, implement network-level controls to block external access to port 9005 until proper authentication is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...