CVE-2026-90446: API Path Injection Information Disclosure

CVE-2026-90446 Overview

CVE-2026-90446 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting an application programming interface (API) endpoint that interpolates user-supplied input directly into the path of a backend request to an underlying search and analytics data store. Because the endpoint does not restrict the contents of the supplied value, an authenticated attacker can substitute an arbitrary backend path. The application's own elevated service credentials are then reused against unintended internal endpoints. This allows enumeration or reading of internal configuration and administrative data that should be inaccessible. The issue is documented in CISA ICS Advisory ICSA-26-254-01.

Critical Impact
Authenticated attackers can leverage the application's elevated service credentials to read internal configuration and administrative data from the backend search and analytics data store.

Affected Products

Product details published in CISA ICS Advisory ICSA-26-254-01
Vendor and specific component names not enumerated in the NVD entry
Refer to the linked CSAF advisory for the authoritative affected product list

Discovery Timeline

2026-09-11 - CVE-2026-90446 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90446

Vulnerability Analysis

The affected API endpoint accepts a user-controlled value and inserts it directly into the URL path of an outbound request to the backend search and analytics data store. Because the value is not validated, sanitized, or constrained to an expected route, an authenticated attacker can rewrite the outbound path to target arbitrary backend endpoints. Requests are dispatched using the application's own service account, which holds elevated privileges against the data store. The vulnerability requires authentication with low privileges and no user interaction, and it is exploitable over the network. Impact is limited to confidentiality of backend data; integrity and availability are not directly affected.

Root Cause

The root cause is missing input validation on a path segment used to construct a server-side HTTP request. The application concatenates untrusted input into the backend request URL rather than enforcing an allowlist of permitted endpoints or mapping user values to fixed internal routes. This pattern matches the classic Server-Side Request Forgery weakness described in CWE-918.

Attack Vector

An authenticated attacker sends a crafted request to the vulnerable API endpoint, replacing the expected path fragment with a target backend route such as an internal administrative or configuration index in the search and analytics store. The application forwards the request using its service credentials. The backend returns data the attacker could not access directly, including cluster metadata, index contents, or administrative configuration. The vulnerability manifests entirely through legitimate API traffic, which complicates identification at the network layer. See CISA ICS Advisory ICSA-26-254-01 for vendor-supplied technical details.

Detection Methods for CVE-2026-90446

Indicators of Compromise

Backend data store access logs showing requests to administrative or internal indices originating from the application service account outside of normal operational patterns.
API request logs containing unusual path characters, traversal sequences, or unexpected backend route names in parameters that should carry constrained values.
Spikes in read operations against configuration, security, or metadata indices from the application tier.

Detection Strategies

Instrument the vulnerable API endpoint to log the raw user-supplied path fragment and alert on values that deviate from an expected allowlist.
Correlate application-tier authentication events with backend data store queries to identify low-privileged users triggering privileged backend reads.
Baseline the set of backend endpoints legitimately accessed by the application and alert on first-seen paths.

Monitoring Recommendations

Enable and centralize audit logging on the search and analytics data store, including caller identity, target index, and operation type.
Forward application and data store logs to a centralized analytics platform for cross-tier correlation and long-term retention.
Monitor for enumeration behavior such as sequential access to system indices or repeated 403 and 404 responses from the backend.

How to Mitigate CVE-2026-90446

Immediate Actions Required

Apply the vendor-supplied patch referenced in CISA ICS Advisory ICSA-26-254-01 as soon as it is available for your deployment.
Restrict authenticated access to the affected API endpoint to only accounts that require it, and review recent access for anomalous activity.
Rotate credentials used by the application to communicate with the backend data store if compromise is suspected.

Patch Information

Refer to CISA ICS Advisory ICSA-26-254-01 for the authoritative patch and fixed-version information. The advisory is published in CSAF format and enumerates affected products, remediation status, and vendor guidance.

Workarounds

Enforce an allowlist at the API layer that maps user input to a fixed set of permitted backend paths rather than interpolating values directly.
Reduce the privileges of the service account the application uses against the backend data store to the minimum required indices and operations.
Deploy a reverse proxy or web application firewall rule that blocks backend path segments (for example, administrative or system indices) in requests to the vulnerable endpoint.

bash

# Configuration example
# Refer to CISA ICS Advisory ICSA-26-254-01 for vendor-specific remediation configuration.