CVE-2026-6986
Improper Authentication Tag Verification in Cesanta Mongoose GCM
Publication date: 2026-04-25
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cesanta | mongoose | From 7.0 (inc) to 7.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6986 is a critical cryptographic vulnerability in the Cesanta Mongoose embedded web server's built-in TLS implementation, specifically in the AES-128-GCM cipher handling within the function mg_aes_gcm_decrypt().
The core issue is that the decryption function completely omits verification of the GCM authentication tag, which is essential for ensuring data integrity and authenticity in AES-GCM encryption.
Technically, the decrypt function lacks parameters for the authentication tag and additional authenticated data (AAD), hardcodes the tag length to zero, and always returns success regardless of whether the ciphertext was tampered with.
This flaw allows attackers to perform bit-flipping attacks on encrypted TLS traffic, modifying data undetected and breaking the security guarantees of TLS connections using this library.
How can this vulnerability impact me? :
This vulnerability can lead to a complete loss of authentication and integrity guarantees in TLS connections using Mongoose's built-in AES-128-GCM implementation.
- Attackers can modify encrypted TLS records at the byte level, enabling undetected tampering of HTTP headers, JSON fields, MQTT payloads, or other application data.
- Session and credential hijacking is possible by altering authentication tokens, API keys, or session identifiers transmitted over TLS.
- Malicious command injection can occur on IoT devices relying on TLS for secure command and control, allowing unauthorized commands to be executed.
Overall, this vulnerability undermines the confidentiality and integrity of data transmitted over TLS, giving attackers the ability to manipulate sensitive information without detection.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying usage of the affected Cesanta Mongoose versions up to 7.20, specifically those using the built-in TLS AES-128-GCM implementation with the flawed mg_aes_gcm_decrypt() function.
Since the vulnerability allows undetected bit-flipping attacks on encrypted TLS traffic, network detection may require monitoring for unusual or manipulated TLS records or unexpected behavior in encrypted communications.
No specific detection commands are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the Cesanta Mongoose library to version 7.21 or later, where this vulnerability has been fixed.
Upgrading addresses the improper verification of the cryptographic signature in the AES-GCM decryption function and restores proper authentication tag handling.
Until the upgrade can be applied, consider limiting exposure by restricting remote access to affected services and monitoring for suspicious activity related to TLS traffic.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Cesanta Mongoose's built-in TLS AES-128-GCM implementation leads to a complete loss of authentication and integrity guarantees for encrypted data. This means that encrypted TLS traffic can be modified undetectably by attackers, allowing tampering with sensitive information such as authentication tokens, session identifiers, and command data.
Such undetected data manipulation undermines the security assurances expected by common standards and regulations like GDPR and HIPAA, which require protection of data integrity and confidentiality during transmission. The vulnerability could therefore lead to non-compliance with these regulations by exposing protected data to unauthorized modification and potential breaches.