Live › vulnerability › CVE-2026-121024
AxxonNet's Health Monitoring service on Linux, before version 3.28.0, does not check permissions properly for a shared report token that is meant to be read-only. A remote attacker holding such a token can create, change or delete monitoring alerts through the monitoring API.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
AxxonNet installations on Linux running a version before 3.28.0 that issue or accept shared report tokens and expose the monitoring API to attackers. Systems that do not use shared report tokens or do not expose the monitoring API are less exposed; the sources do not say more.
No product ranges from the sources yet.
3.28.0 or later, per the sources' 'before 3.28.0' range.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.
This page as .md · .json · in your agent: get_signal("CVE-2026-121024")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.