CVE-2026-31309 describes an improper authorization vulnerability in the /tequilapi/config/user endpoint of Mysterium Node software. Versions from v1.21.1-rc0 before v1.36.0 are affected. An unauthenticated attacker can send a specially crafted POST request to this endpoint to arbitrarily overwrite the node's configuration. This can result in a full takeover of the node. The vulnerability is categorized under CWE-862 (Improper Authorization). No official patch or remediation level has been provided in the available data, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to arbitrarily modify the configuration of a Mysterium Node, leading to a complete compromise of the node. This can undermine the integrity and control of the affected system without requiring any prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /tequilapi/config/user endpoint to trusted users or networks if possible. Monitor for any unusual configuration changes and consider disabling or isolating vulnerable nodes.