CVE-2026-48692 Missing authorization in n/a

High 8.1 Published 26 May 2026 Updated 26 May 2026

Unauthenticated gRPC API allows attackers to ban IPs, disable DDoS mitigation, and execute scripts via popen.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-48692?

CVE-2026-48692 is a high-severity missing authorization vulnerability in n/a, published on 26 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

Weakness: CWE-306

Which versions are affected by CVE-2026-48692?

It affects 1 product.

Products include Pavel-Odintsov Fastnetmon.

How do I fix CVE-2026-48692?

No fix has been published for CVE-2026-48692 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-48692 being exploited?

There is no known exploitation of CVE-2026-48692 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-48692, GHSA-w743-79pp-vx63, UBUNTU-CVE-2026-48692.