CVE-2026-31983

MEDIUM

Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0

Title source: cna

Description

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH keys.

References (1)

Core 1

Core References

https://security.nozominetworks.com/NN-2026:10-01

Scores

CVSS v3 5.3

EPSS 0.0024

EPSS Percentile 14.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (4)

Nozomi Networks/CMC < 26.2.0

Nozomi Networks/Guardian < 26.2.0

nozominetworks/cmc < 26.2.0

nozominetworks/guardian < 26.2.0

Published Jul 09, 2026

Tracked Since Jul 09, 2026