CVE-2026-102136

Received Received - Intake

Command Injection in Appliance Cluster Interface

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102136

EUVD

EUVD-2026-90279

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker with code execution on one node in a multi-node system to send a specially crafted value through an internal cluster interface. This value is then written to the monitoring configuration on another node without proper validation, potentially enabling the execution of operating system commands. The impact is limited to an unprivileged service account on the affected node.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run unauthorized commands on a node where they only have limited access. This could lead to further compromise of the system, data exfiltration, or disruption of services within the cluster.

Mitigation Strategies

Isolate affected nodes to prevent lateral movement. Review and restrict access to internal cluster interfaces. Validate all inputs submitted through these interfaces to prevent command injection. Monitor for unusual activity in monitoring configurations.

Hi! I’m here to help you understand CVE-2026-102136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70