9.1
CriticalCVSS 4.0 · from hackerone
CVE-2026-108142
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
Backup and Replication · CWE-636 · CWE-636AffectedBackup and Replication
FixUpdate to 13.0.3, 13.1.2 or newer
PublishedOct 27, 16:16 · hackerone
ScoredOct 27 · 9.1 · hackerone
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can change data and take the service down. CVSS impact.
Description
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
From hackerone
Affected and fixed versions
ProductAffectedFixed inBackup and Replication13.0 – before 13.0.313.0.3Backup and Replication13.1 – before 13.1.213.1.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known