CVE-2026-5246 Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization
Remote attackers can bypass authorization in Cesanta Mongoose via manipulated P-384 public key signatures, requiring complex exploitation techniques.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5246?
CVE-2026-5246 is a medium-severity authentication bypass vulnerability in Cesanta Mongoose, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Which versions are affected by CVE-2026-5246?
It affects 1 product.
Products include Cesanta Mongoose.
How do I fix CVE-2026-5246?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-5246 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5246 exists.
Other vulnerabilities in Cesanta Mongoose
Sources
Also known as DEBIAN-CVE-2026-5246, GHSA-hm7q-jq63-pr78, JLSEC-2026-371, UBUNTU-CVE-2026-5246.