CVE-2026-6807

Full vulnerability record from the local CVENow database.

Description

A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.

Severity

MEDIUM

CVSS score

5.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-04-28 19:37:47.773000

Last modified

2026-10-26 20:10:00.160000

View original CVE JSON

{
  "id": "CVE-2026-6807",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-28T19:37:47.773",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [
    {
      "sourceIdentifier": "[email protected]",
      "tags": [
        "unsupported-when-assigned"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling of XML input, which may result in unintended \nexposure of sensitive information. The flaw stems from insufficient \nhardening of the XML parsing process."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en GRASSMARLIN v3.2.1 permite que datos de sesión especialmente diseñados desencadenen un manejo inadecuado de la entrada XML, lo que puede resultar en la exposición involuntaria de información sensible. El fallo se debe a un endurecimiento insuficiente del proceso de análisis XML."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NSA",
          "product": "GRASSMARLIN",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "All versions",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-29T13:40:03.937436Z",
          "id": "CVE-2026-6807",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-118-01.json",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01",
      "source": "[email protected]"
    }
  ]
}