CVE-2026-108336: Token Signing Key Allows Unauthenticated Administrative Access
When the default self-signed certificate is used, an attacker could gain administrative access to the application.
The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Remote Ops Agentto a version that resolves this vulnerability.Fixed in 2.1 - Configuration
Replace the default self-signed certificate used by the web interface with a different certificate.
Remote Ops Agent web interface SSL certificate = A certificate different from the default self-signed certificate
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the default self-signed SSL certificate for the web interface are exposed. The provided information does not indicate that installations using a different certificate are affected.
What does an attacker need to exploit this vulnerability?
An attacker needs the ability to use the default certificate's signing capability to create JWT access tokens accepted by the application. The issue allows login bypass without authentication when the default self-signed certificate is in use.
What could an attacker do after exploitation?
An attacker could obtain administrative access and perform administrative actions such as configuring the service or requesting log collection. The vulnerability does not provide access to device credentials or customer data.
What should be checked during triage?
Check whether the web interface is still configured with the default self-signed SSL certificate. If it is, treat the deployment as affected and replace the default certificate with a non-default certificate.