{"id":"CVE-2026-121024","kind":"vulnerability","aliases":["CVE-2026-121024"],"related":[],"title":"AxxonNet: shared read-only report token can change monitoring alerts","description":"Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.","summary":"AxxonNet's Health Monitoring service on Linux, before version 3.28.0, does not check permissions properly for a shared report token that is meant to be read-only. A remote attacker holding such a token can create, change or delete monitoring alerts through the monitoring API.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axxonnet","linux","other","self-hosted"],"not_affected_if":["no-shared-report-tokens","version-3.28.0-or-later"],"how_to_check":"- Check the installed AxxonNet version on Linux hosts; the sources do not give a command.\n- Look for shared report tokens in use and whether the monitoring API is reachable from outside the network.","fix":"- AxxonNet `3.28.0` or later, per the sources' 'before 3.28.0' range.","status":"open","published_at":"2026-11-03T09:17:12+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","triaged_at":"2026-11-03T09:20:25+00:00","updated_at":"2026-11-03T09:20:25+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T09:20:25Z","model":"claude-haiku-5-5","output":{"fix":"- AxxonNet `3.28.0` or later, per the sources' 'before 3.28.0' range.","reach":"network","title":"AxxonNet: shared read-only report token can change monitoring alerts","impact":"medium","summary":"AxxonNet's Health Monitoring service on Linux, before version 3.28.0, does not check permissions properly for a shared report token that is meant to be read-only. A remote attacker holding such a token can create, change or delete monitoring alerts through the monitoring API.","audience":"businesses","category":"other","nicknames":[],"who_cares":["axxonnet","linux","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker alters or deletes monitoring alerts using a read-only token","analyst_note":"","how_to_check":"- Check the installed AxxonNet version on Linux hosts; the sources do not give a command.\n- Look for shared report tokens in use and whether the monitoring API is reachable from outside the network.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.28.0-or-later","no-shared-report-tokens"],"who_is_affected":"AxxonNet installations on Linux running a version before 3.28.0 that issue or accept shared report tokens and expose the monitoring API to attackers. Systems that do not use shared report tokens or do not expose the monitoring API are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4144,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121024':14A,17A '-2026':13A,16A '-863':73C '3.28.0':33B,83C 'access':104C 'alert':11A,65B,111C 'allow':86C 'api':69B,115C 'attack':54B,89C 'author':71C 'axxonnet':1A,18B,24B,81C 'axxonsoft':80C 'chang':9A,61B 'check':36B 'creat':60B,106C 'cve':12A,15A 'cwe':72C 'delet':63B,109C 'health':26B,76C 'hold':55B 'host':23B 'incorrect':70C 'intend':99C 'linux':19B,30B,85C 'meant':46B 'modifi':107C 'monitor':10A,27B,64B,68B,77C,110C,114C 'permiss':37B 'possess':91C 'proper':38B 'read':4A,50B,102C 'read-on':3A,49B,101C 'remot':53B,88C 'report':6A,42B,95C 'self':22B 'self-host':21B 'servic':28B,78C 'share':2A,41B,94C 'token':7A,43B,58B,96C 'version':32B 'via':112C","nicknames":[],"mitigations":[],"who_affected":"AxxonNet installations on Linux running a version before 3.28.0 that issue or accept shared report tokens and expose the monitoring API to attackers. Systems that do not use shared report tokens or do not expose the monitoring API are less exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["axxonnet","linux","medium","other","selfhosted"],"first_public_at":"2026-11-03T09:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"15ede60e-6fda-426e-be9c-e788f151a377","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121024","severity":null,"published_at":"2026-11-03T09:17:12+00:00","modified_at":"2026-11-03T09:17:12+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","fetched_at":"2026-11-03T09:19:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}