CVE-2026-90454: Packet Analysis Component Auth Bypass Flaw

CVE-2026-90454 Overview

CVE-2026-90454 is a missing authorization vulnerability [CWE-862] affecting a deployment mode of a bundled packet-analysis component. The deployment mode is designed to expose only read access to the component's interface. It enforces this restriction by denying a list of write-capable routes using a pattern match. The pattern omits the routes that add or remove tags on stored session records, and the proxy configuration allows the request method those routes use. An authenticated user can therefore modify tags on stored session records in a deployment intended to be read-only.

Critical Impact
An authenticated user on a read-only deployment can add or remove tags on stored session records, altering analyst-facing metadata used to triage network sessions.

Affected Products

Bundled packet-analysis component deployed in read-only mode (vendor and product not specified in NVD entry)
Deployments referenced in the associated CISA ICS advisory ICSA-26-254-01
Configurations relying on proxy-level route denylists to enforce read-only access

Discovery Timeline

2026-09-11 - CVE-2026-90454 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90454

Vulnerability Analysis

The vulnerability is a missing authorization issue in a deployment mode that is intended to expose read-only access to a bundled packet-analysis interface. Enforcement is implemented at the proxy layer through a denylist of write-capable route patterns rather than through authorization checks in the application.

The denylist does not cover routes that mutate tags attached to stored session records. Because the proxy configuration allows the HTTP request method those routes use, requests to add or remove tags pass through to the backend. The backend processes the request without additional authorization checks tied to deployment mode.

The outcome is a limited integrity impact: an authenticated user can change tag metadata on stored session records. Confidentiality and availability are not affected, and no privilege escalation to other write operations is described in the advisory.

Root Cause

The root cause is an incomplete route denylist combined with reliance on proxy-level filtering to enforce a security boundary. The tag-modification endpoints were not included in the denied route patterns, and the application does not independently validate that the deployment mode permits the operation. This is a classic instance of [CWE-862: Missing Authorization].

Attack Vector

The attack vector is network-based and requires authentication to the read-only interface. An authenticated user issues a request to a tag-modification route using the request method permitted by the proxy configuration. Because the denylist pattern does not match the route, the request reaches the backend and is processed. The vulnerability mechanism is described in prose only; no verified proof-of-concept code is available. Refer to the CISA ICS Alert Report for the authoritative technical description.

Detection Methods for CVE-2026-90454

Indicators of Compromise

Requests to tag-modification endpoints of the packet-analysis component originating from sessions authenticated to a read-only deployment.
Unexpected additions or removals of tags on stored session records without a corresponding change ticket or analyst action.
Proxy access logs showing successful responses for tag-mutation routes on hosts configured for read-only access.

Detection Strategies

Compare the effective proxy denylist against the full list of write-capable routes exposed by the packet-analysis component and alert on any gaps.
Correlate authentication events on read-only deployments with backend write activity on session tag routes.
Audit session record histories for tag changes and attribute each change to a specific authenticated user and source address.

Monitoring Recommendations

Enable and centralize access logging at both the proxy and the packet-analysis backend for all routes, not only denied ones.
Forward audit events for session tag modifications into your security analytics platform for retention and review.
Alert on any write-method request that reaches the backend from a deployment labeled read-only.

How to Mitigate CVE-2026-90454

Immediate Actions Required

Apply the vendor patch referenced in the CISA ICS Alert Report as soon as it is available for your deployment.
Restrict authenticated access to read-only deployments to the minimum set of users that require it.
Review recent tag changes on stored session records and roll back any modifications that cannot be attributed to authorized activity.

Patch Information

The National Vulnerability Database entry for CVE-2026-90454 does not enumerate fixed versions. Consult the CISA ICS Alert Report for vendor-supplied remediation guidance, including affected versions and patched releases.

Workarounds

Extend the proxy denylist to explicitly deny the tag-modification routes on read-only deployments until a vendor fix is installed.
Block the HTTP request method used by the tag routes at the proxy for read-only deployments, if the method is not required for legitimate read traffic.
Place the read-only interface behind a network segment that only permits monitoring workstations, reducing the population of authenticated users that can reach the routes.

bash

# Configuration example: extend proxy denylist to cover tag-modification routes
# Adjust route paths and method to match your deployment's actual API surface.
location ~* ^/api/.*/sessions/.*/tags(/|$) {
    return 403;
}