The vulnerability exists in the internal Access Control List subsystem of kronosnet version 1.34 and earlier. When dynamic links are managed without encryption, the ACL framework trusts the link ID provided in network packets without proper validation. An attacker can spoof this link ID remotely without authentication, bypassing ACL controls and injecting arbitrary data into the application layer. This can lead to data corruption or instability in the affected service. The CVSS 3.1 base score is 4.8 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

A remote unauthenticated attacker can bypass the ACL framework by spoofing link IDs, allowing injection of arbitrary data packets. This may result in data corruption or service instabilities in the affected application. There is no confidentiality impact reported. The integrity and availability impacts are low but present.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-15812 for current remediation guidance. Until a patch or official fix is available, avoid configuring kronosnet to accept network traffic from any IP address without encryption, as this configuration enables the vulnerability. Monitor vendor updates for official fixes.