CVE-2026-9831 ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition
A race condition in Extreme Platform ONE allows attackers to access another tenant's data via API key authentication under high concurrency.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9831?
CVE-2026-9831 is a medium-severity vulnerability in Extreme Platform ONE, published on 29 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.
Which versions are affected by CVE-2026-9831?
How do I fix CVE-2026-9831?
No fix has been published for CVE-2026-9831 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9831 being exploited?
There is no known exploitation of CVE-2026-9831 in the wild and no public exploit code.
Sources
Also known as GHSA-w637-mwv9-mchj.