CVE-2026-6807 NSA GRASSMARLIN Improper Restriction of XML External Entity Reference
Crafted session data triggers improper XML handling in NSA GRASSMARLIN, potentially exposing sensitive information to attackers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6807?
CVE-2026-6807 is a medium-severity vulnerability in NSA GRASSMARLIN, published on 28 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
Weakness: CWE-611
Which versions are affected by CVE-2026-6807?
How do I fix CVE-2026-6807?
No fix has been published for CVE-2026-6807 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6807 being exploited?
There is no known exploitation of CVE-2026-6807 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-w2pw-52qg-478g.