CVE-2026-107243 · Infrastructure
NO FIX YET
The Node.js provisioning web service on Versa VOS (formerly FlexVNF) signs session cookies with a hardcoded secret shared by every VOS appliance. An attacker who obtains a valid session ID can forge a cookie that any VOS appliance in the deployment accepts.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
VOS appliances that still run the Node.js web service used for URL-based zero touch provisioning are exposed. Per the description, disabling that service after initial provisioning, as Versa's hardening guide recommends, removes the exposure. Appliances where the service is disabled are not affected.
Not affected if provisioning-complete, service-disabled
Who cares sd-wan, self-hosted, versa-flexvnf, versa-vos
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.