{"id":"CVE-2026-95613","kind":"vulnerability","aliases":["CVE-2026-95613"],"related":[],"title":"Zenitel Connect: forged tokens grant PostgreSQL superuser access via pREST API","description":"The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the \"postgres\" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.","summary":"The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and checks JSON Web Tokens with the platform CA private key, which sits on a volume shared between containers. An attacker who reads that key can forge a token naming the postgres superuser and run database operations as it, including reading the master encryption key and password hashes.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","postgresql","prest","zenitel-connect"],"not_affected_if":["firmware-1.11.0-or-later"],"how_to_check":"- Check the Zenitel Connect firmware version on the device or in its admin interface; versions before `1.11.0` are affected.\n- Look for the pREST API service in the Connect platform containers and confirm whether the shared data volume holds the platform CA private key.","fix":"- Zenitel Connect firmware: move to `1.11.0` or later.","status":"open","published_at":"2026-11-13T16:19:38+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","triaged_at":"2026-11-13T16:48:20+00:00","updated_at":"2026-11-13T16:48:20+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T16:48:20Z","model":"claude-haiku-5-5","output":{"fix":"- Zenitel Connect firmware: move to `1.11.0` or later.","reach":"local","title":"Zenitel Connect: forged tokens grant PostgreSQL superuser access via pREST API","impact":"high","summary":"The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and checks JSON Web Tokens with the platform CA private key, which sits on a volume shared between containers. An attacker who reads that key can forge a token naming the postgres superuser and run database operations as it, including reading the master encryption key and password hashes.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["zenitel-connect","pREST","postgresql","embedded"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs any database operation as PostgreSQL superuser, reading secrets.","analyst_note":"","how_to_check":"- Check the Zenitel Connect firmware version on the device or in its admin interface; versions before `1.11.0` are affected.\n- Look for the pREST API service in the Connect platform containers and confirm whether the shared data volume holds the platform CA private key.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["firmware-1.11.0-or-later"],"who_is_affected":"Teams running Zenitel Connect firmware before 1.11.0 with the pREST database API present. The exposure requires local access to the container filesystem to read the platform CA private key from the shared data volume, so the risk sits with anyone who can reach the device's containers. Installations already on 1.11.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4647,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-95613':14A,17A '1.11.0':35B,95C 'access':8A 'allow':140C 'api':11A,29B,89C,183C 'attack':57B,142C 'ca':45B,103C,148C 'check':38B 'claim':126C 'connect':2A,24B,32B,92C,131C 'contain':55B,115C,153C 'cve':12A,15A 'data':111C 'databas':27B,72B,87C,134C,157C 'embed':18B 'encrypt':80B,167C 'execut':156C 'filesystem':154C 'firmwar':33B,93C 'forg':3A,63B,174C 'grant':5A 'hash':84B,171C 'includ':76B,163C 'infrastructur':19B 'json':39B 'jwt':175C 'jwts':99C 'key':47B,61B,81B,105C,150C,168C 'local':141C 'master':79B,166C 'name':66B 'oper':73B,158C 'password':83B,170C 'platform':44B,102C,147C 'postgr':68B,137C,178C 'postgresql':6A,20B,119C,161C 'prest':10A,21B,26B,86C,182C 'privat':46B,104C,149C 'read':59B,77B,145C,164C 'request':129C 'rest':28B,88C 'role':121C 'run':71B 'sent':179C 'session':120C 'set':117C 'share':53B,113C 'sign':36B,96C 'sit':49B 'store':108C 'sub':125C,177C 'superus':7A,69B,138C,162C 'token':4A,41B,65B 'unvalid':124C 'verifi':98C 'via':9A,172C 'volum':52B,112C 'web':40B 'zenitel':1A,23B,31B,91C 'zenitel-connect':22B","nicknames":[],"mitigations":[],"who_affected":"Teams running Zenitel Connect firmware before 1.11.0 with the pREST database API present. The exposure requires local access to the container filesystem to read the platform CA private key from the shared data volume, so the risk sits with anyone who can reach the device's containers. Installations already on 1.11.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","infrastructure","postgresql","prest","zenitelconnect"],"campaign_type":null,"search_a":"'-2026':13A,16A '-95613':14A,17A 'access':8A 'api':11A 'connect':2A 'cve':12A,15A 'forg':3A 'grant':5A 'postgresql':6A 'prest':10A 'superus':7A 'token':4A 'via':9A 'zenitel':1A","search_b":"'1.11.0':35B 'api':29B 'attack':57B 'ca':45B 'check':38B 'connect':24B,32B 'contain':55B 'databas':27B,72B 'embed':18B 'encrypt':80B 'firmwar':33B 'forg':63B 'hash':84B 'includ':76B 'infrastructur':19B 'json':39B 'key':47B,61B,81B 'master':79B 'name':66B 'oper':73B 'password':83B 'platform':44B 'postgr':68B 'postgresql':20B 'prest':21B,26B 'privat':46B 'read':59B,77B 'rest':28B 'run':71B 'share':53B 'sign':36B 'sit':49B 'superus':69B 'token':41B,65B 'volum':52B 'web':40B 'zenitel':23B,31B 'zenitel-connect':22B","search_c":"'1.11.0':95C 'allow':140C 'api':89C,183C 'attack':142C 'ca':103C,148C 'claim':126C 'connect':92C,131C 'contain':115C,153C 'data':111C 'databas':87C,134C,157C 'encrypt':167C 'execut':156C 'filesystem':154C 'firmwar':93C 'forg':174C 'hash':171C 'includ':163C 'jwt':175C 'jwts':99C 'key':105C,150C,168C 'local':141C 'master':166C 'oper':158C 'password':170C 'platform':102C,147C 'postgr':137C,178C 'postgresql':119C,161C 'prest':86C,182C 'privat':104C,149C 'read':145C,164C 'request':129C 'rest':88C 'role':121C 'sent':179C 'session':120C 'set':117C 'share':113C 'sign':96C 'store':108C 'sub':125C,177C 'superus':138C,162C 'unvalid':124C 'verifi':98C 'via':172C 'volum':112C 'zenitel':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95613","severity":null,"published_at":"2026-11-13T16:19:38+00:00","modified_at":"2026-11-13T16:19:38+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","fetched_at":"2026-11-13T16:47:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}