{"id":"CVE-2026-9831","aliases":["EUVD-2026-33445","GHSA-w637-mwv9-mchj"],"status":"published","title":"ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition","description":"A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00172,"percentile":0.06668,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362","CWE-488"],"published":"2026-05-29T21:19:17Z","modified":"2026-07-22T06:10:00Z","products":[{"vendor":"extreme networks","product":"extreme platform one"}],"references":[{"url":"https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9831"},{"url":"https://github.com/advisories/GHSA-w637-mwv9-mchj"}],"sources":{"cve":[{"id":"CVE-2026-9831","title":"ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition","description":"A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.","status":"published","published":"2026-05-29T21:19:17.118Z","modified":"2026-06-01T13:53:05.14Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-362","CWE-488"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-33445","description":"A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.","status":"published","published":"2026-05-29T21:19:17Z","modified":"2026-06-01T13:53:05Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:58.729223Z"}],"ghsa":[{"id":"GHSA-w637-mwv9-mchj","title":"A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could...","description":"A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.","status":"published","published":"2026-05-30T00:30:31Z","modified":"2026-05-30T00:30:31Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:08:24.903932Z"}],"nvd":[{"id":"CVE-2026-9831","description":"A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.","status":"published","published":"2026-05-29T22:16:23.98Z","modified":"2026-07-22T06:10:00.17Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-362","CWE-488"],"updated_at":"2026-11-02T14:12:21.635958Z"}]}}