CVE-2026-15812: kronosnet ACL Auth Bypass Vulnerability

CVE-2026-15812 Overview

CVE-2026-15812 is an authentication spoofing vulnerability [CWE-290] in the internal Access Control List (ACL) subsystem of kronosnet versions 1.34 and earlier. The flaw exists when the framework is configured to manage dynamic links that accept traffic from any IP address without network payload encryption. Under this configuration, the validation architecture implicitly trusts the link ID contained within incoming data packets. A remote, unauthenticated attacker can spoof a legitimate link ID in crafted network frames to bypass ACL checks and inject arbitrary packets into the application layer.

Critical Impact
Successful exploitation allows unauthenticated attackers to bypass ACL controls, inject data packets into the application layer, and cause data corruption or service instability in clustered environments relying on kronosnet.

Affected Products

kronosnet versions <= 1.34
Distributions and applications bundling vulnerable kronosnet (see Red Hat advisory)
Deployments using dynamic links without network payload encryption

Discovery Timeline

2026-07-21 - CVE-2026-15812 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-15812

Vulnerability Analysis

Kronosnet is a network abstraction layer used by high-availability clustering software to provide redundant, encrypted communication channels between cluster nodes. The framework identifies communication endpoints using a link ID field embedded in packet metadata.

The vulnerability arises in configurations where administrators enable dynamic link management. Dynamic links accept incoming traffic from any source IP address, which is typical for environments where node addresses are not fixed. When network payload encryption is disabled, the framework has no cryptographic mechanism to verify packet authenticity and instead trusts the link ID declared within the packet itself.

Because the ACL subsystem consults the attacker-controlled link ID to determine whether traffic is authorized, an attacker who guesses or observes a valid link ID can present packets that appear to originate from a trusted node. This constitutes authentication by assertion, the class of weakness described in [CWE-290].

Root Cause

The root cause is trust placed in untrusted input. The ACL validation path uses the link ID from the incoming frame as the primary identity signal without applying cryptographic verification. In dynamic-link mode without encryption, no other binding exists between the packet source and the claimed identity.

Attack Vector

Exploitation requires network access to the kronosnet listener and knowledge of a valid link ID or the ability to enumerate one. The attacker crafts UDP-based kronosnet frames containing the spoofed link ID and sends them to the target node. Because there is no encryption or source validation, the receiver accepts the frame and delivers the payload to the application layer, where it may corrupt cluster state or destabilize services. The higher attack complexity reflected in the CVSS vector accounts for the specific configuration prerequisites and the need to produce a valid link ID.

No verified public exploit code is available. For technical details, refer to the Red Hat CVE-2026-15812 Advisory and Red Hat Bug 2500851 Description.

Detection Methods for CVE-2026-15812

Indicators of Compromise

Unexpected kronosnet frames arriving from source IP addresses not associated with known cluster members.
Cluster log entries showing packet acceptance from previously unseen peers on kronosnet UDP ports.
Application-layer data anomalies or cluster state inconsistencies without a corresponding legitimate node event.

Detection Strategies

Inspect kronosnet configuration files for dynamic link mode combined with disabled crypto_model or crypto_cipher settings.
Correlate cluster membership changes with network flow records to identify frames from unauthorized sources.
Deploy network intrusion detection signatures that alert on kronosnet traffic originating outside the approved cluster subnet.

Monitoring Recommendations

Enable verbose logging on the kronosnet layer to capture link ID usage and source addresses for each accepted frame.
Forward cluster and host telemetry to a centralized analytics platform for baseline analysis of peer communication patterns.
Alert on repeated malformed or unexpected frames on kronosnet ports, which may indicate link ID enumeration attempts.

How to Mitigate CVE-2026-15812

Immediate Actions Required

Upgrade kronosnet to a version above 1.34 once a fixed release is published by the vendor.
Enable network payload encryption on all kronosnet links to bind identity to cryptographic material rather than to a spoofable link ID.
Restrict kronosnet listener exposure to trusted management networks using host firewalls or network ACLs.

Patch Information

Refer to the Red Hat CVE-2026-15812 Advisory for distribution-specific package updates. Track Red Hat Bug 2500851 Description for upstream fix status and backported patches.

Workarounds

Disable dynamic link mode and configure static links with explicit peer IP addresses where operationally feasible.
Configure kronosnet with a supported crypto_model and shared key so that packets without valid authentication are rejected before ACL evaluation.
Segment cluster interconnect traffic onto a dedicated VLAN or physically isolated network to limit attacker reachability.

bash

# Example: enforce encryption on kronosnet links in a Corosync configuration
totem {
    version: 2
    crypto_cipher: aes256
    crypto_hash: sha256
    crypto_model: openssl
}