CVE-2026-6807: NSA GRASSMARLIN Improper Restriction of XML External Entity Reference
Published Apr 28, 2026
·Updated
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
Affected Software
1 affected component
NSA GRASSMARLIN=3.2.1
Event History
Apr 28, 2026
CVE Published
via MITRE·05:41 PM
Data Sourced
via MITRE·05:41 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:37 PM
DescriptionSeverityWeakness
Apr 29, 2026
News Published
via The Register·03:35 PM
News Published
via The Register·03:37 PM
Jul 2, 58309
Event
via FIRST·05:25 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-6807?
CVE-2026-6807 has been classified with a high severity due to the potential exposure of sensitive information.
2
How do I fix CVE-2026-6807?
To fix CVE-2026-6807, upgrade GRASSMARLIN to version 3.2.2 or later.
3
What products are affected by CVE-2026-6807?
CVE-2026-6807 specifically affects GRASSMARLIN version 3.2.1.
4
What type of vulnerability is CVE-2026-6807?
CVE-2026-6807 is an XML parsing vulnerability that allows improper handling of input.
5
What risks are associated with CVE-2026-6807?
The risks associated with CVE-2026-6807 include unintended exposure and potential theft of sensitive data.