CVE-2023-46326

8.8 highEPSS 0.7%

High (8.8) in zstack zstack. EPSS 0.7% chance of exploitation in the next 30 days.

ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2023-11-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zstack:zstack

References

https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q
https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q

Check your stack JSON