CVE-2026-30799: RTI Connext Authentication Bypass Flaw

CVE-2026-30799 Overview

CVE-2026-30799 is a Missing Authentication for Critical Function vulnerability [CWE-306] in the RTI Connext Professional Security Plugins. The flaw allows identity spoofing within Data Distribution Service (DDS) deployments that rely on the Security Plugins for authenticated communication. An attacker with low privileges on the network can impersonate a legitimate participant and inject or alter data flowing across the DDS domain.

Affected releases span multiple major versions of Connext Professional, from 5.3.0 through pre-7.7.0 builds. The issue is reachable over the network and does not require user interaction.

Critical Impact
Identity spoofing in DDS middleware undermines authentication guarantees, allowing attackers to impersonate trusted publishers or subscribers and tamper with the integrity and availability of distributed system data.

Affected Products

RTI Connext Professional 7.4.0 through versions before 7.7.0
RTI Connext Professional 7.0.0 through 7.3.x
RTI Connext Professional 5.3.x, 6.0.x, and 6.1.x branches

Discovery Timeline

2026-06-17 - CVE-2026-30799 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-30799

Vulnerability Analysis

The Connext Professional Security Plugins implement the DDS Security specification, which defines authentication, access control, and cryptographic protection for participants exchanging data on a DDS domain. CVE-2026-30799 reflects a missing authentication check on a critical function within these plugins. Because the check is absent, the middleware accepts inputs or operations that should only be permitted to authenticated participants.

The practical consequence is identity spoofing. An adversary can present themselves as another DDS participant and interact with topics or services without holding the corresponding cryptographic identity. This breaks the trust model that secure DDS deployments rely on for safety-critical and mission-critical workloads.

Root Cause

The root cause is the absence of an authentication step on a code path that performs a security-relevant action. CWE-306 describes this pattern: a function that should validate the caller's identity proceeds without doing so. In the context of the Security Plugins, the omission allows participant identity assertions to be accepted without sufficient verification.

Attack Vector

Exploitation is network-based and requires only low privileges on the DDS domain. The attacker crafts traffic that triggers the unauthenticated function path, then operates with the identity of another participant. There is no user interaction requirement, and the impact targets integrity and availability of DDS data while confidentiality is reported as unaffected.

No public exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the RTI Vulnerability Advisory CVE-2026-30799 for vendor-specific technical detail.

Detection Methods for CVE-2026-30799

Indicators of Compromise

Unexpected DDS participants joining a domain using GUIDs or identity certificates that duplicate those of legitimate nodes.
Discovery announcements or topic publications originating from network endpoints that do not match the inventory of authorized DDS hosts.
Sudden integrity anomalies in subscribed topics, such as duplicate or conflicting samples for the same instance key.

Detection Strategies

Enable verbose logging in the Security Plugins and alert on authentication errors, handshake retries, and participant identity mismatches.
Correlate DDS discovery traffic with an authoritative asset inventory to flag participants whose network origin diverges from expected hosts.
Baseline normal publisher and subscriber counts per topic, then alert on deviations that indicate spoofed participants.

Monitoring Recommendations

Capture and retain DDS RTPS traffic on critical segments for offline forensic review.
Forward Connext logs and host telemetry from DDS endpoints to a centralized SIEM for cross-source correlation.
Monitor certificate and permissions file usage on hosts running Connext to detect unauthorized reuse of identity material.

How to Mitigate CVE-2026-30799

Immediate Actions Required

Inventory all systems running RTI Connext Professional and identify versions in the affected ranges.
Restrict DDS traffic to trusted network segments using firewall rules and VLAN segmentation until patches are applied.
Rotate identity certificates and governance and permissions documents if spoofing is suspected.

Patch Information

RTI addresses the issue in Connext Professional 7.7.0 and later. Users on earlier branches should consult the RTI Vulnerability Advisory CVE-2026-30799 for branch-specific fix availability and upgrade guidance.

Workarounds

Tighten DDS governance and permissions documents to minimize the topics and actions available to each participant identity.
Place DDS participants behind authenticated transport layers, such as TLS-protected tunnels or IPsec, to limit network reachability of the affected function.
Disable or restrict optional Security Plugins features that are not required by the deployment to reduce the attack surface.

bash

# Example: restrict DDS RTPS traffic to known participant subnets
iptables -A INPUT -p udp --dport 7400:7500 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7400:7500 -j DROP