CVE-2026-31983CWE-306

CVE-2026-31983

Medium · published July 9, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH keys.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-09T12:16Z
Affected products (2)
ProductVersionsFixed in
nozominetworks/cmc< 26.2.026.2.0
nozominetworks/guardian< 26.2.026.2.0
References (2)
https://security.nozominetworks.com/NN-2026:10-01 · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-827968.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 09 JUL 07:22Z
    Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0
    cvelistv5