---
id: "CVE-2026-108142"
kind: "vulnerability"
aliases: ["CVE-2026-108142"]
title: "CDP Coordinator Service: unauthenticated attacker bypasses authorization checks"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Veeam Backup & Replication", "fixed": ["13.1.2.57", "13.0.3.63"], "affected": "<= 13.1.1.18 (13.1); <= 13.0.2.29 (13.0)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-bypass", "backup", "cdp", "cdp-coordinator-service", "other", "unauthenticated", "veeam", "veeam-backup-replication"]
not_affected_if: ["patched-13.0.3", "patched-13.1.2", "veeam-12.x"]
published_at: "2026-10-27T17:16:57+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:35:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108142", "first_seen_at": "2026-10-27T17:32:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:35:22+00:00"}]
---

# CDP Coordinator Service: unauthenticated attacker bypasses authorization checks

Veeam Backup & Replication's CDP Coordinator Service (VeeamBackupCdpSvc, on the backup server) lets an unauthenticated network attacker bypass authorization. Veeam rates it Critical (CVSS v4 9.1), reported via HackerOne. Veeam gives no exploitation details and we found no exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Backup & Replication affected <= 13.1.1.18 (13.1); <= 13.0.2.29 (13.0) fixed 13.1.2.57, 13.0.3.63

## How to check

Check the Veeam Backup & Replication build number in the console (Help > About) or on the appliance. Builds 13.1.1.18 and earlier 13.1, or 13.0.2.29 and earlier 13.0, are vulnerable. 12.x is not affected.

## Fix

Update Veeam Backup & Replication to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63). Veeam lists no workaround.

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108142
- 2026-10-27T17:35:22+00:00 analyst — Veeam KB4948 (vendor, 2026-10-27) names it: Veeam Backup & Replication CDP Coordinator Service; fixed in 13.1.2.57 / 13.0.3.63. No exploitation or PoC found; no public discussion searched beyond web search.

## Documents

- [advisory] KB4948: Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2 https://www.veeam.com/kb4948
- [describes] Backup Infrastructure for CDP - Veeam User Guide https://helpcenter.veeam.com/docs/vbr/userguide/cdp_infrastructure.html

## From the sources

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_