---
id: "CVE-2026-66279"
kind: "vulnerability"
aliases: ["CVE-2026-66279"]
title: "Connect SDK and Flex SDK: crafted message bypasses authentication, disrupts network"
severity: "high"
cvss: 7.2
epss: 0.00245
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["connect-sdk", "flex-sdk", "network", "package"]
not_affected_if: ["sdk-not-used"]
published_at: "2026-10-22T14:17:43+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:27:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66279", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-66279", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Connect SDK and Flex SDK: crafted message bypasses authentication, disrupts network

Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier accept a message with invalid security settings that can get past authentication. An attacker can use it to disrupt network traffic, but the sources say it does not expose the Network Key or break confidentiality.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Connect SDK version against `4.3.1` and the Flex SDK version against `3.7.7`, in the project's dependency manifest or lockfile
- unknown whether other check paths exist; the sources do not say

## Fix

- Upgrade Connect SDK to a release newer than `4.3.1`
- Upgrade Flex SDK to a release newer than `3.7.7`
- unknown exact fixed versions; the sources do not name them

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66279
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-66279

## From the sources

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_