Description
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
Published: 2026-10-06
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

CVE-2026-102161 has been fixed in the following releases: - 2026.2.1 and later releases

Vendor Workaround

There is no mitigation or workaround available for this issue.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
Title Security Advisory 0190
Weaknesses CWE-290
CWE-798
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Arista

Published:

Updated: 2026-10-06T20:04:10.245Z

Reserved: 2026-09-28T17:41:09.358Z

Link: CVE-2026-102161

cve-icon Vulnrichment

Updated: 2026-10-06T20:04:06.876Z

cve-icon NVD

Status : Received

Published: 2026-10-06T20:17:11.230

Modified: 2026-10-06T21:17:02.997

Link: CVE-2026-102161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing

  • CWE-798

    Use of Hard-coded Credentials