All vulnerabilities
CVE-2026-103053GHSA-g4h7-p63q-r8r4

AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

beenuar AiSOC
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 30 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.0.0Fixed versionCVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.

Text from CVE List

Affected versions 1

  • AiSOCaffected: 9.0.0 before 12.0.0CVE List

References 5