CVE-2026-48692

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

• CWE-306

• https://github.com/pavel-odintsov/fastnetmonProduct
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/api.cppProduct
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cppProduct
• https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48692-grpc-no-authThird Party Advisory

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48686FastNetMon Community Edition through 1.2.9 contains a stack-…9.8
• CVE-2026-48687FastNetMon Community Edition through 1.2.9 contains an OS co…9.8
• CVE-2026-48688FastNetMon Community Edition through 1.2.9 contains multiple…7.5
• CVE-2026-48689FastNetMon Community Edition through 1.2.9 contains an off-b…9.8
• CVE-2026-48690FastNetMon Community Edition through 1.2.9 contains an integ…7.1
• CVE-2026-48691FastNetMon Community Edition through 1.2.9 contains an integ…9.8
• CVE-2026-48693FastNetMon Community Edition through 1.2.9 is vulnerable to …5.5
• CVE-2026-48694FastNetMon Community Edition through 1.2.9 contains a config…8.1
• CVE-2026-48695FastNetMon Community Edition through 1.2.9 contains an OS co…8.1
• CVE-2026-48696FastNetMon Community Edition through 1.2.9 has a buffer over…6.2
• CVE-2026-48697FastNetMon Community Edition through 1.2.9 does not verify T…7.4
• CVE-2026-4870IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker …7.5