Live › vulnerability › CVE-2026-111684
Go to dashboardMagistrala through 1.0.0 lets an authenticated workspace member act on certificates belonging to other tenants by supplying foreign serials or entity ids. An attacker can disclose certificates, revoke other tenants' devices, and issue CA-signed certificates for their own device ids.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Magistrala through 1.0.0 with multiple tenants or workspaces sharing one deployment are exposed, since the flaw crosses tenant boundaries. Single-tenant deployments where every user is trusted are less exposed. The sources do not name a fixed version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| magistrala | vendor | <= 1.0.0 | – |
v1.0.0 (also v0.51.0 and v0.40.0 per reporter) = exposedv1.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.
This page as .md · .json · in your agent: get_signal("CVE-2026-111684")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.