CVE-2026-6807

NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

View on CVE.org
Published Apr 28, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to
trigger improper handling of XML input, which may result in unintended
exposure of sensitive information. The flaw stems from insufficient
hardening of the XML parsing process.

Analysis

AI-generated

Technical impact

A vulnerability in GRASSMARLIN v3.2.1 allows an attacker to craft session data that triggers the parsing of XML external entity references, a weakness classified as CWE-611. The inadequate hardening of the XML parser permits the application to read data from external sources specified by the attacker, potentially exposing sensitive information that the system processes or stores.

Affected Systems

The affected system is the NSA GRASSMARLIN project, version 3.2.1. No additional versions or vendors are listed in the advisory.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and no EPSS score is available. The vulnerability is not listed in CISA KEV. The likely attack vector is an attacker able to submit crafted XML within session data—either through a remote interface that accepts XML input or via local manipulation of session files. Because the project is end‑of‑life and no patch exists, the only effective risk mitigation is to retire the application or enforce strict XML parsing safeguards.

Remediation

Vendor Workaround

NSA has indicated that the GRASSMARLIN project has reached end-of-life status as of 2017 and is no longer supported. The project is archived, and no patches or further updates are planned or expected.

OpenCVE Recommended Actions

  • Decommission GRASSMARLIN and migrate to a supported platform that uses hardened XML parsing.
  • If decommissioning is not immediately possible, reconfigure or update the XML parser to disable external entity processing or apply a temporary patch that enforces safe handling.
  • Continuously monitor for anomalous XML traffic and employ runtime monitoring to detect attempts to exploit XML-based weaknesses.

Generated by OpenCVE AI on April 28, 2026 at 23:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Nsa
Nsa grassmarlin
Vendors & Products Nsa
Nsa grassmarlin
Type Values Removed Values Added
Description A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
Title NSA GRASSMARLIN Improper Restriction of XML External Entity Reference
Weaknesses CWE-611
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference

Sources

Status
PUBLISHED
Assigner
icscert
Published
Updated
Apr 29, 2026, 3:12 PM
Reserved
Apr 21, 2026, 4:01 PM

View source JSON

Updated
Apr 29, 2026, 1:42 PM

JSON

Status
Awaiting Analysis
Published
Apr 28, 2026, 7:37 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 10:10 AM

JSON