CWE-306: Missing Authentication vulnerabilities

CVE-2026-105281 is a vulnerability in the Grid Protection Alliance openPDC product where the internal data publisher accepts network connections without authentication by default. This allows an unauthenticated attacker to connect remotely and retrieve the full device and measurement topology of the system. The vulnerability affects multiple versions prior to 2.9.477, 2.9.482, 2.8.580, and 2.8.585. The CVSS 3.1 base score is 7.5, indicating high severity due to the ability to obtain sensitive configuration information without privileges.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a vulnerability where critical functions lack proper authentication. This allows unauthenticated remote attackers to potentially access sensitive information and bypass protection mechanisms. The vulnerability is identified as CWE-306 and has a high severity with a CVSS score of 7.5.

CVE-2026-77900 is a critical vulnerability in Microsoft Azure App Service for Linux where missing authentication for a critical function allows unauthorized remote code execution. The flaw enables attackers to execute code over the network without any privileges or user interaction. Microsoft has issued an official fix and manages remediation for this cloud service.

IBM Guardium Data Protection versions 12.2 and 12.2.2 contain a critical vulnerability (CVE-2026-84249) due to missing authentication for a critical function. This flaw allows a remote attacker to execute arbitrary management operations without authentication. The vulnerability has a CVSS 3.1 score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.

IBM Guardium Data Protection versions 12.1 and 12.2.2 contain a critical vulnerability in the edge-controller component due to missing authentication. This flaw allows an unauthenticated remote attacker to execute arbitrary container images, potentially gaining control over managed edge clusters. The vulnerability is identified as CWE-306 and has a CVSS 3.1 score of 9.8, indicating a critical severity level.

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.

CVE-2026-87664 is a high-severity vulnerability in Brocade Fabric OS affecting versions prior to 9.2.2d and versions 10.0.0 through 10.0.0a1. It involves a session context forgery in the web management daemon where local IPC storage callbacks are accepted without verifying the sender's identity. This allows attackers to gain elevated administrative privileges on the web management interface without proper authentication.

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

Homer, an open source telecom observability software, had a critical vulnerability (CVE-2026-62253) prior to version 11.0.283 where its JWT middleware functions allowed unauthenticated access to protected API endpoints. This was due to the JWT secret defaulting to an empty string, causing the middleware to bypass authentication checks. The issue was fixed in version 11.0.283.

LMCache versions from 0.3.9 up to but not including 0.5.6 contain a critical deserialization vulnerability in multiprocess (distributed) mode. This mode opens an unauthenticated ZeroMQ ROUTER socket that accepts msgpack messages. When processing these messages, the server calls pickle.loads on untrusted data before request handling, allowing remote code execution as the LMCache process user. Official containers run this process as root, increasing risk. The vulnerability is fixed in version 0.5.6, which removes the unsafe pickle.loads call.

CVE-2026-102159 is a critical access-control vulnerability in Arista Networks CloudVision CUE. It involves missing authentication for a critical backend function, allowing unauthenticated network attackers to access internal service functionality. Exploitation can lead to exposure of sensitive location information and disruption of affected services. The vulnerability affects versions from 2022.3.0 through 2026.2.0 inclusive. The CVSS score is 9.8, indicating a critical severity level.

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 have a vulnerability due to missing authentication in the csm-authorization-tenant gRPC service. This flaw allows an unauthenticated adjacent network attacker to create tenant entities, inject roles across tenants, and modify storage access control flags without authorization. The vulnerability is classified as CWE-306 and carries a high severity with a CVSS score of 7.1.

Dell Container Storage Modules versions prior to 1.18.0 have a critical vulnerability due to missing authentication for a critical function. This flaw allows an unauthenticated remote attacker to potentially elevate privileges, impacting confidentiality, integrity, and availability. The vulnerability is identified as CWE-306 and carries a CVSS 3.1 score of 10.0, indicating critical severity.

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.