CVE-2026-5246
Authorization Bypass in Cesanta Mongoose P-384 TLS Verification
Publication date: 2026-04-02
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cesanta | mongoose | From 7.0 (inc) to 7.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Cesanta Mongoose up to version 7.20, specifically in the function mg_tls_verify_cert_signature within the mongoose.c file, which handles the P-384 Public Key. An attacker can manipulate this function to bypass authorization.
The attack can be executed remotely but is considered highly complex and difficult to exploit. The vulnerability has been publicly disclosed, and an exploit may be available.
Upgrading to version 7.21 of Cesanta Mongoose addresses this issue.
How can this vulnerability impact me? :
This vulnerability can lead to an authorization bypass, meaning an attacker could gain unauthorized access or privileges within the affected system.
Since the attack can be performed remotely, it increases the risk of unauthorized access from external sources.
However, the exploit is considered highly complex and difficult to execute, which may reduce the likelihood of successful attacks.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Cesanta Mongoose to version 7.21, which contains the patch 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 that fixes the issue.
Upgrading the affected component is recommended as the vendor has released this fixed version promptly after being contacted.