Live › vulnerability › CVE-2026-104383
Go to dashboardPigeon MFA service in EagleCloud Aquila through 2.6.7.2 on on-premises installs has an improper code generation flaw (CWE-94 style code injection). An authenticated remote attacker can inject input that is executed as code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 05:31 UTC. All times on this page are UTC.
On-premises deployments of EagleCloud Aquila through version 2.6.7.2 that run the Pigeon MFA service are affected. Cloud-hosted or non-Aquila deployments are not described as affected by the sources, and the sources do not say which configurations beyond on-premises are exposed.
No product ranges from the sources yet.
2.6.7.2; the sources say versions through 2.6.7.2 are affected2.6.7.2 once the vendor publishes a fixed release (fixed version not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection
This page as .md · .json · in your agent: get_signal("CVE-2026-104383")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.