{"id":"CVE-2026-108142","kind":"vulnerability","aliases":["CVE-2026-108142"],"related":[],"title":"CDP Coordinator Service: unauthenticated attacker bypasses authorization checks","description":"A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.","summary":"Veeam Backup & Replication's CDP Coordinator Service (VeeamBackupCdpSvc, on the backup server) lets an unauthenticated network attacker bypass authorization. Veeam rates it Critical (CVSS v4 9.1), reported via HackerOne. Veeam gives no exploitation details and we found no exploitation or public PoC.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Veeam Backup & Replication","fixed":["13.1.2.57","13.0.3.63"],"affected":"<= 13.1.1.18 (13.1); <= 13.0.2.29 (13.0)","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-bypass","backup","cdp","cdp-coordinator-service","other","unauthenticated","veeam","veeam-backup-replication"],"not_affected_if":["patched-13.0.3","patched-13.1.2","veeam-12.x"],"how_to_check":"Check the Veeam Backup & Replication build number in the console (Help > About) or on the appliance. Builds 13.1.1.18 and earlier 13.1, or 13.0.2.29 and earlier 13.0, are vulnerable. 12.x is not affected.","fix":"Update Veeam Backup & Replication to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63). Veeam lists no workaround.","status":"open","published_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:16+00:00","updated_at":"2026-10-27T17:35:22+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-27T17:34:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CDP Coordinator Service: unauthenticated attacker bypasses authorization checks","impact":"high","summary":"The CDP Coordinator Service has a flaw that lets an unauthenticated attacker get past its authorization checks. The sources do not say what the service does beyond that, or what the attacker can then reach.","category":"other","nicknames":[],"who_cares":["cdp-coordinator-service"],"confidence":0.3,"needs_auth":"no","worst_case":"unknown; attacker bypasses authorization without credentials","analyst_note":"Find the vendor or product behind the CDP Coordinator Service, its affected versions and fixed release, using https://nvd.nist.gov/vuln/detail/CVE-2026-108142","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000502,"input_tokens":3257,"output_tokens":352,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor or product behind the CDP Coordinator Service, its affected versions and fixed release, using https://nvd.nist.gov/vuln/detail/CVE-2026-108142","search":"'-108142':11A,14A '-2026':10A,13A '9.1':59B 'allow':78C 'attack':5A,50B,81C 'auth':19B 'auth-bypass':18B 'author':7A,52B,84C 'backup':16A,21B,32B,35B,44B 'bypass':6A,20B,51B,83C 'cdp':1A,22B,24B,38B,87C 'cdp-coordinator-servic':23B 'check':8A 'coordin':2A,25B,39B,88C 'critic':56B 'cve':9A,12A 'cvss':57B 'detail':67B 'exploit':66B,72B 'found':70B 'give':64B 'hackeron':62B 'let':46B 'network':49B 'poc':75B 'public':74B 'rate':54B 'replic':33B,36B 'replication':17A 'report':60B 'server':45B 'servic':3A,26B,40B,89C 'unauthent':4A,28B,48B,80C 'v4':58B 'veeam':15A,29B,31B,34B,53B,63B 'veeam-backup-repl':30B 'veeambackupcdpsvc':41B 'via':61B 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Veeam Backup & Replication 13.0 or 13.1, Windows-based or Veeam Software Appliance, below the fixed builds. The CDP Coordinator Service runs on the backup server, so look at any backup server whose network is reachable by untrusted hosts. Version 12.x installs can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-27T17:35:22Z","by":"analyst","run_id":892},"products":{"at":"2026-10-27T17:35:22Z","by":"analyst","run_id":892}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108142","severity":null,"published_at":"2026-10-27T17:16:57+00:00","modified_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108142:892","url":null,"severity":null,"published_at":"2026-10-27T17:35:22+00:00","modified_at":"2026-10-27T17:35:22+00:00","first_seen_at":"2026-10-27T17:35:22+00:00","fetched_at":"2026-10-27T17:35:22+00:00","note":"Veeam KB4948 (vendor, 2026-10-27) names it: Veeam Backup & Replication CDP Coordinator Service; fixed in 13.1.2.57 / 13.0.3.63. No exploitation or PoC found; no public discussion searched beyond web search."}],"documents":[{"id":7177,"url":"https://www.veeam.com/kb4948","title":"KB4948: Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7179,"url":"https://helpcenter.veeam.com/docs/vbr/userguide/cdp_infrastructure.html","title":"Backup Infrastructure for CDP - Veeam User Guide","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}