CVE-2026-90457

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing algorithm used for the same password on another authentication path. A party able to read this file, including a local user or a party with access to a configuration backup, could feasibly recover the underlying password through offline computation, compromising the administrative credential across every path that accepts it.

• CWE-916

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json

Published

Sep 11, 2026

Last Modified

Sep 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90451An example environment-configuration file ships with a fixed…8.2
• CVE-2026-90452Requests from the reverse proxy to the identity-provider ser…6
• CVE-2026-90453A file-upload handler redirects the authenticated client's b…5.1
• CVE-2026-90454A deployment mode intended to expose only read access to a b…5.3
• CVE-2026-90455A prior update that raised a bundled HTTP client library to …6.3
• CVE-2026-90456An example environment-configuration file for a bundled inve…9.2
• CVE-2026-9046A potential insecure permissions vulnerability was reported …7.3
• CVE-2026-90460An issue was discovered in OpenStack Keystone before 29.0.3.…7.6
• CVE-2026-90461OpenStack Ironic through 38.0.0 may send a username and pass…6.3
• CVE-2026-90467aiosmtplib before 5.1.3 fails to properly validate email add…4
• CVE-2026-9047Improper handling of factor key state in the multi-factor au…7.6
• CVE-2026-90472msgpack-java through 0.9.12 contains a stack overflow vulner…5.3