CVE-2026-105161CWE-345CWE-347

CVE-2026-105161

Medium · published October 4, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
3.3
In the wild
Unconfirmed
What it is

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade the affected component. The GitHub repository of this project is not available anymore. This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00143 · 3.3th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-10-04T22:16Z
References (6)
https://github.com/advisories/GHSA-73p9-6hrp-8qhr · [email protected]https://github.com/invariant-systems-ai/aiir/ · [email protected]https://github.com/invariant-systems-ai/aiir/security/advisories/GHSA-73p9-6hrp-8qhr · [email protected]https://vuldb.com/cve/CVE-2026-105161 · [email protected]https://vuldb.com/vuln/413387 · [email protected]https://vuldb.com/vuln/413387/cti · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 04 OCT 16:30Z
    invariant-systems-ai aiir Policy Gate signature verification
    cvelistv5