{"id":"CVE-2026-115486","kind":"vulnerability","aliases":["CVE-2026-115486"],"related":[],"title":"open-iscsi iscsiuio: IPv6 neighbor packets let attackers poison ARP tables","description":"A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.","summary":"iscsiuio (open-iscsi) reads IPv6 Neighbor Discovery link-layer options without a length check and updates the ARP table from packet headers, so a host on the same L2 segment can poison ARP and redirect iSCSI traffic. Only hosts using iSCSI offload NICs (QLogic/Broadcom bnx2, bnx2x, qedi) with the iscsiuio daemon running are exposed. Software iSCSI (plain iscsid on ordinary NICs) and systems without offload hardware can skip it. Red Hat mitigation: keep iscsiuio interfaces on trusted L2 segments and filter ICMPv6 type 135/136 from untrusted sources.","severity":"high","cvss":7.1,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[{"name":"open-iscsi","fixed":[],"affected":"all versions (no fixed version published; Debian 2.1.8-2.1.13 listed vulnerable)","ecosystem":"linux"}],"ecosystems":[],"tags":["infrastructure","ipv6","iscsi","iscsiuio","layer2","linux","open-iscsi","self-hosted"],"not_affected_if":["no-iscsi","no-iscsi-offload-hardware","software-iscsi","trusted-l2-segment"],"how_to_check":"Run 'systemctl status iscsiuio' or 'pgrep iscsiuio' to see whether the daemon runs, and 'iscsiadm -m iface' to look for bnx2i/qedi offload transports. If neither shows, you are not exposed. Check the package with 'dpkg -l open-iscsi' or 'rpm -q iscsi-initiator-utils'.","fix":"unknown: no fixed open-iscsi version published as of 2026-10-25; Debian and Red Hat list it unfixed. Watch Red Hat Bugzilla 2556267 and the open-iscsi GitHub repo.","status":"open","published_at":"2026-10-23T01:16:53+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:31:21+00:00","updated_at":"2026-10-25T04:02:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:31:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"open-iscsi iscsiuio: IPv6 neighbor packets let attackers poison ARP tables","impact":"medium","summary":"The iscsiuio component of open-iscsi reads IPv6 Neighbor Discovery link-layer address options at a fixed offset without checking the packet is long enough, and it updates the ARP table with addresses taken from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison ARP entries and redirect traffic.","category":"infrastructure","nicknames":[],"who_cares":["open-iscsi","iscsi","linux","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Network traffic from the host is redirected by poisoned ARP entries","analyst_note":"Find the fixed open-iscsi version and affected range in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115486) and confirm whether iscsiuio is only used with iSCSI offload.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-iscsi"],"who_is_affected":"Hosts that run iscsiuio from open-iscsi, typically those using iSCSI boot or offload, are the systems to look at. The sources do not say which versions are affected or whether hosts without iscsiuio running can skip it. The attacker needs to be on the same layer-2 network segment.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00061,"input_tokens":3387,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed open-iscsi version and affected range in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115486) and confirm whether iscsiuio is only used with iSCSI offload.","search":"'-115486':15A,18A '-2026':14A,17A '135/136':119B 'access':140C 'addit':156C 'address':144C,167C 'advertis':184C 'arp':11A,53B,68B,158C,188C 'attack':9A,165C,173C 'attacker-control':164C 'bnx2':80B 'bnx2x':81B 'check':49B 'compon':130C 'contain':154C 'control':166C 'cve':13A,16A 'daemon':86B 'discoveri':41B,138C 'expos':89B 'filter':116B 'fix':148C 'flaw':124C 'found':126C 'handler':139C 'hardwar':101B 'hat':106B 'header':57B,171C 'host':33B,60B,74B 'icmpv6':117B 'infrastructur':22B 'interfac':110B 'ipv6':5A,23B,39B,136C 'iscsi':3A,21A,24B,30B,37B,71B,76B,91B,134C 'iscsid':93B 'iscsiuio':4A,25B,34B,85B,109B,129C 'keep':108B 'l2':64B,113B 'layer':44B,143C 'layer2':26B 'length':48B 'let':8A 'link':43B,142C 'link-lay':42B,141C 'linux':27B 'minim':182C 'mitig':107B 'neighbor':6A,40B,137C,183C 'network':177C,192C 'nic':78B,96B 'offload':77B,100B 'offset':149C 'open':2A,20A,29B,36B,133C 'open-iscsi':1A,19A,28B,35B,132C 'option':45B,145C 'ordinari':95B 'packet':7A,56B,153C,170C 'plain':92B 'poison':10A,67B,186C 'qedi':82B 'qlogic/broadcom':79B 'read':38B 'red':105B 'redirect':70B,191C 'run':87B 'segment':65B,114B,178C 'self':32B 'self-host':31B 'send':180C 'skip':103B 'softwar':90B 'sourc':122B 'system':98B 'tabl':12A,54B,159C,189C 'traffic':72B,193C 'trust':112B 'type':118B 'uncondit':162C 'untrust':121B 'updat':51B,161C 'use':75B 'verifi':151C 'without':46B,99B,150C","nicknames":[],"mitigations":[],"who_affected":"Hosts that run iscsiuio from open-iscsi, typically those using iSCSI boot or offload, are the systems to look at. The sources do not say which versions are affected or whether hosts without iscsiuio running can skip it. The attacker needs to be on the same layer-2 network segment.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T01:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115486","severity":null,"published_at":"2026-10-23T01:16:53+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115486","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115486","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115486:806","url":null,"severity":null,"published_at":"2026-10-25T04:02:54+00:00","modified_at":"2026-10-25T04:02:54+00:00","first_seen_at":"2026-10-25T04:02:54+00:00","fetched_at":"2026-10-25T04:02:54+00:00","note":"Red Hat advisory read: affects only hosts with hardware iSCSI offload NICs (bnx2/bnx2x/qedi) where iscsiuio runs; no upstream fixed version published yet (Debian tracker: bookworm/trixie/forky/sid all vulnerable; CVE record has no affected range). Not exploited, no PoC found; EPSS ~0.002. Red Hat rates Moderate; severity kept. No dedicated who_is_affected flag in write, so it is in summary."}],"documents":[{"id":3372,"url":"https://access.redhat.com/security/cve/CVE-2026-115486","title":"Red Hat CVE-2026-115486","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3373,"url":"https://security-tracker.debian.org/tracker/source-package/open-iscsi","title":"Debian tracker: open-iscsi","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3374,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115486","title":"CVE Record CVE-2026-115486","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}