CVE-2026-95614 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Zenitel Connect before 1.11.0 applies an rsyslog configuration file from a data volume shared with the hiatus container. An attacker who can write to that container's filesystem can plant a crafted rsyslog config and run arbitrary OS commands as root on the host.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running Zenitel Connect before 1.11.0 where the hiatus application container shares a data volume with the host configuration watcher. Exposure depends on who can write inside the hiatus container; hosts without that shared volume or without a writable hiatus container are less exposed.
Not affected if version-1.11.0-or-later
Who cares hiatus, rsyslog, self-hosted, zenitel-connect
1.11.0.hiatus application container.1.11.0 or later.The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.