{"id":"CVE-2026-31309","aliases":["EUVD-2026-42495","GHSA-p7gf-g6r8-g65h"],"status":"published","title":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node before v1.36.0...","description":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0062,"percentile":0.5006,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862"],"published":"2026-07-08T00:00:00Z","modified":"2026-10-28T02:30:33Z","exploits":[{"source":"pocgithub","id":"Sch8ill/CVE-2026-31309","title":"Sch8ill/CVE-2026-31309","date":"2026-04-10","url":"https://github.com/Sch8ill/CVE-2026-31309"}],"references":[{"url":"https://github.com/mysteriumnetwork/node/","tags":["web"]},{"url":"https://github.com/mysteriumnetwork/node/commit/bc099fcaff59fee9c8a8f8e07ffff5b3c5df2bb9","tags":["fix"]},{"url":"https://github.com/sch8ill/CVE-2026-31309","tags":["exploit","package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31309","tags":["advisory"]},{"url":"https://github.com/mysteriumnetwork/node/commit/83051199cd641dd4ed9057b958e5616df1309f19"},{"url":"https://github.com/mysteriumnetwork/node"},{"url":"https://github.com/mysteriumnetwork/node/blob/1.35.5/tequilapi/tequil/routes.go#L26"},{"url":"https://github.com/mysteriumnetwork/node/releases/tag/1.35.5"},{"url":"https://github.com/mysteriumnetwork/node/releases/tag/1.36.0"},{"url":"https://github.com/advisories/GHSA-p7gf-g6r8-g65h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31309.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-31309","description":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-16T12:21:40.263Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:51.277563Z"}],"euvd":[{"id":"EUVD-2026-42495","description":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-16T12:21:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:51.881225Z"}],"ghsa":[{"id":"GHSA-p7gf-g6r8-g65h","title":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node before v1.36.0...","description":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node before v1.36.0 allows unauthenticated attackers to arbitrarily overwrite the node's configuration and achieve a full node takeover via supplying a crafted POST request.","status":"published","published":"2026-07-09T00:31:14Z","modified":"2026-07-09T18:31:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:09:21.623271Z"}],"nvd":[{"id":"CVE-2026-31309","description":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.","status":"published","published":"2026-07-08T22:17:13.84Z","modified":"2026-07-16T13:16:30.707Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-31309","description":"Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-10-28T02:30:33.686350154Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:00.861953Z"}]}}