CVE-2026-90448: Read-Only Mode Auth Bypass Vulnerability

CVE-2026-90448 Overview

CVE-2026-90448 is a missing authorization vulnerability [CWE-862] affecting a deployment mode intended to expose only read access to stored data. The affected software proxies a set of application programming interface (API) routes without restricting which HTTP request methods are permitted. An authenticated user can invoke a write-capable route that creates or overwrites stored records using an attacker-chosen identifier. The proxy performs the operation using the application's own elevated backend credentials, bypassing the read-only constraint of the deployment mode.

Critical Impact

An authenticated user on a deployment intended to be read-only can forge or overwrite stored records that should not be modifiable, undermining data integrity in operational technology environments.

Affected Products

• Product details published in CISA ICS Advisory ICSA-26-254-01
• Deployments configured in read-only mode that proxy API routes
• Environments where backend service credentials are used to fulfill proxied requests

Discovery Timeline

• 2026-09-11 - CVE-2026-90448 published to the National Vulnerability Database (NVD)
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90448

Vulnerability Analysis

The vulnerability arises from an authorization gap in a read-only deployment mode. The deployment proxies a set of API routes to a backend service but does not enforce restrictions on which request methods are allowed through the proxy. Because the proxy authenticates upstream using the application's own elevated backend credentials, any request that reaches the backend inherits the privileges required to modify stored data.

One of the proxied routes accepts requests that create or overwrite a stored record. The requester can supply an arbitrary identifier for the target record. An authenticated user who should have only read privileges can therefore write records, overwrite existing records, or introduce records under identifiers they choose. The read-only guarantee of the deployment mode is a policy expressed only at the intended user interface layer, not enforced by the proxy or the backend.

Root Cause

The root cause is missing authorization [CWE-862] at the proxy layer. The proxy validates that a caller is authenticated but does not check whether the caller is permitted to invoke a state-changing method on the proxied route. Method filtering (for example, restricting proxied traffic to GET and HEAD) is absent. Trust in the deployment mode label substitutes for enforcement in code.

Attack Vector

An authenticated user with network access to the read-only deployment issues a request to a proxied API route with a write-capable method and an attacker-chosen record identifier. The proxy forwards the request to the backend using its elevated credentials. The backend processes the request as authorized and creates or overwrites the stored record. No additional privileges or user interaction are required. Refer to CISA ICS Advisory ICSA-26-254-01 for vendor-specific technical details.

Detection Methods for CVE-2026-90448

Indicators of Compromise

• Unexpected write requests (POST, PUT, PATCH, DELETE) reaching proxied API routes on deployments configured as read-only.
• Stored records with identifiers that do not match expected naming conventions or that appear outside of normal provisioning workflows.
• Backend audit logs showing record create or overwrite operations attributed to the proxy service account rather than to human administrators.

Detection Strategies

• Compare proxy access logs against the deployment mode configuration and alert on any non-idempotent HTTP method reaching a read-only proxy.
• Baseline the set of record identifiers written by the proxy service account, and flag deviations from that baseline.
• Correlate authenticated user session identifiers with downstream backend write operations to detect privilege inheritance patterns.

Monitoring Recommendations

• Enable verbose request logging on the proxy layer, including HTTP method, route, caller identity, and target identifier.
• Forward proxy and backend logs into a centralized analytics platform for cross-layer correlation and long-term retention.
• Alert on any successful write response returned to a client session that was authenticated under the read-only role.

How to Mitigate CVE-2026-90448

Immediate Actions Required

• Review the vendor advisory at CISA ICS Advisory ICSA-26-254-01 and apply the recommended fixed version.
• Restrict network access to the read-only deployment to trusted administrative networks until a patch is applied.
• Rotate the elevated backend credentials used by the proxy if compromise is suspected.

Patch Information

Refer to the vendor guidance in CISA ICS Advisory ICSA-26-254-01 for the fixed release and upgrade procedure. No public exploit or proof of concept has been listed for CVE-2026-90448 at the time of publication.

Workarounds

• Place a reverse proxy or web application firewall in front of the read-only deployment to reject any HTTP method other than GET and HEAD on proxied API routes.
• Deploy a separate backend service account for the read-only proxy with database or storage privileges limited to read operations.
• Audit stored records for unauthorized creations or modifications and restore from backup where integrity cannot be verified.

# Configuration example
Refer to CISA ICS Advisory ICSA-26-254-01 for vendor-specific configuration guidance.