CVE-2026-103105: High severity Pexip Infinity vulnerability
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Pexip Infinity versions before 38.2, and versions 39.0, 39.1, and 40.0, are affected. The issue applies to nodes within a Pexip Infinity installation.
What access does an attacker need to exploit this?
An attacker needs local access to a node in the Pexip Infinity installation. No privileges or user interaction are required according to the provided vector.
What could an attacker do after exploiting the issue?
The attacker can execute arbitrary code as an unprivileged user on another Pexip Infinity node. The vulnerability is rated high severity with high confidentiality, integrity, and availability impact.