CVE-2026-103106

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to run arbitrary code on a node by either achieving remote code execution via some other vulnerability or having administrative access to the operating system.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.pexip.com/admin/security_bulletins.htm	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pexip:pexip_infinity::::::::
	cpe:2.3:a:pexip:pexip_infinity::::::::
	cpe:2.3:a:pexip:pexip_infinity:40.0:::::::*

History

05 Oct 2026, 20:24

Type	Values Removed	Values Added
References	~~() https://docs.pexip.com/admin/security_bulletins.htm -~~	() https://docs.pexip.com/admin/security_bulletins.htm - Vendor Advisory
CPE		cpe:2.3:a:pexip:pexip_infinity:40.0:::::::* cpe:2.3:a:pexip:pexip_infinity::::::::
First Time		Pexip pexip Infinity Pexip

30 Sep 2026, 03:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 03:16

Updated : 2026-10-05 20:24

NVD link : CVE-2026-103106

Mitre link : CVE-2026-103106

CVE.ORG link : CVE-2026-103106

JSON object : View

Products Affected

pexip

pexip_infinity

CWE

CWE-669

Incorrect Resource Transfer Between Spheres

{"id": "CVE-2026-103106", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103106", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-30T18:46:28.832384Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Pexip", "product": "Infinity", "versions": [{"status": "affected", "version": "0", "lessThan": "38.2.0", "versionType": "semver"}, {"status": "affected", "version": "39.0.0", "versionType": "semver"}, {"status": "affected", "version": "39.1.0", "versionType": "semver"}, {"status": "affected", "version": "40.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-30T03:16:59.773", "references": [{"url": "https://docs.pexip.com/admin/security_bulletins.htm", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-669"}]}], "descriptions": [{"lang": "en", "value": "Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to run arbitrary code on a node by either achieving remote code execution via some other vulnerability or having administrative access to the operating system."}], "lastModified": "2026-10-05T20:24:57.777", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFD7712D-CD23-4418-BBDA-006D51921999", "versionEndExcluding": "38.2"}, {"criteria": "cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DD39F66-4440-45B3-9400-3297C4201ECB", "versionEndIncluding": "39.1", "versionStartIncluding": "39.0"}, {"criteria": "cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64CD3049-810D-4C5C-BD91-86A61EECAE8A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}