A flaw was found in the automation-controller instance
install-bundle endpoint. When a System Administrator downloads
an execution/hop node's install bundle, the controller signs an
X.509 certificate with the receptor mesh certificate authority
in which the Common Name, DNS subject-alternative-name, and
receptor node-id are taken verbatim from the caller-chosen
instance hostname, with a hard-coded ten-year validity, a random
serial, and no issuance log or revocation list. Because the
hostname charset validator is case-insensitive while the
uniqueness validator is case-sensitive, an administrator can
register a case variant of an existing control node's hostname
and obtain a mesh-CA-signed certificate that TLS peers, which
match hostnames case-insensitively, accept as that control node.
In managed/hosted deployments — where the customer holds
controller superuser but the platform operator runs the mesh —
this yields a long-lived, non-revocable mesh peer credential and,
with an on-path position, TLS impersonation or interception of
control/hybrid mesh nodes. It does not grant direct remote code
execution, because receptor work submission is gated by a
separate signing key not included in the bundle.
References
Configurations
No configuration.
History
24 Sep 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Sep 2026, 04:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2026, 23:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-23 20:17
Updated : 2026-09-24 16:17
NVD link : CVE-2026-84716
Mitre link : CVE-2026-84716
CVE.ORG link : CVE-2026-84716
JSON object : View
Products Affected
No product.
CWE
CWE-266
Incorrect Privilege Assignment