CVE-2026-95613 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and checks JSON Web Tokens with the platform CA private key, which sits on a volume shared between containers. An attacker who reads that key can forge a token naming the postgres superuser and run database operations as it, including reading the master encryption key and password hashes.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Zenitel Connect firmware before 1.11.0 with the pREST database API present. The exposure requires local access to the container filesystem to read the platform CA private key from the shared data volume, so the risk sits with anyone who can reach the device's containers. Installations already on 1.11.0 or later are not affected.
Not affected if firmware-1.11.0-or-later
Who cares embedded, postgresql, prest, zenitel-connect
1.11.0 are affected.1.11.0 or later.The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.