CVE-2026-35548

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-35548", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-22T15:21:32.153Z", "dateReserved": "2026-04-03T00:00:00.000Z", "datePublished": "2026-04-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-22T14:13:41.396Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://guardsix.com/media-room#/pressreleases/logpoint-becomes-guardsix-as-europe-reassesses-sovereign-security-operations-3436974"}, {"url": "https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T15:20:42.631183Z", "id": "CVE-2026-35548", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T15:21:32.153Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-35548", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T15:20:42.631183Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T15:07:23.969Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://guardsix.com/media-room#/pressreleases/logpoint-becomes-guardsix-as-europe-reassesses-sovereign-security-operations-3436974"}, {"url": "https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-22T14:13:41.396Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35548", "state": "PUBLISHED", "dateUpdated": "2026-04-22T15:21:32.153Z", "dateReserved": "2026-04-03T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-22T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:guardsix:logpoint:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2D3137A-300D-4400-B643-B8E9CCDA06D4", "versionEndExcluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:guardsix:odbc:*:*:*:*:*:*:*:*", "matchCriteriaId": "4722C193-9502-4A23-88EF-8A6ED4F5EE4C", "versionEndExcluding": "5.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en los Complementos de Enriquecimiento ODBC de guardsix (anteriormente Logpoint) anteriores a la versi\u00f3n 5.2.1 (la versi\u00f3n 5.2.1 se utiliza en guardsix 7.9.0.0). Una falla l\u00f3gica permit\u00eda que las credenciales de la base de datos almacenadas se reutilizaran despu\u00e9s de la modificaci\u00f3n del Host, la direcci\u00f3n IP o el puerto de destino. Al editar una Fuente de Enriquecimiento existente, las credenciales almacenadas previamente se reten\u00edan incluso si se cambiaba el punto final de conexi\u00f3n. Un usuario Operador autenticado pod\u00eda redirigir la conexi\u00f3n de la base de datos a sistemas internos no deseados, lo que resultaba en SSRF y un posible uso indebido de credenciales v\u00e1lidas almacenadas."}], "id": "CVE-2026-35548", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35548", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T15:20:42.631183Z", "version": "2.0.3"}}]}, "published": "2026-04-22T15:16:16.100", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://guardsix.com/media-room#/pressreleases/logpoint-becomes-guardsix-as-europe-reassesses-sovereign-security-operations-3436974"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.2.1)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "odbc_enrichment_plugins", "vendor": "guardsix"}], "analysis": {"en": {"generated_at": "2026-04-27T19:23:20.374106+00:00", "value": {"mitigation_remediation": ["Upgrade Guardsix ODBC Enrichment Plugins to version 5.2.1 or later (used in Guardsix 7.9.0.0).", "If an upgrade is not immediately possible, restrict the Operator role so that editing Enrichment Source target host details is disabled or limited to non\u2011sensitive internal services.", "Monitor operational logs for changes to Enrichment Source host, IP, or port and investigate any suspicious internal connections."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery with credential reuse"}, "threat_synthesis": {"affected_systems": "Guardsix ODBC Enrichment Plugins versions prior to 5.2.1 are vulnerable.\nGuardsix 7.9.0.0 uses plugin version 5.2.1, which includes the fix, so systems running that release are not affected.", "description_and_impact": "A logic flaw in Guardsix (formerly Logpoint) ODBC Enrichment Plugins allowed stored database credentials to be reused after the target Host, IP address, or Port was modified.\nWhen an authenticated Operator edited an existing Enrichment Source, previously stored credentials were retained even though the connection endpoint changed, enabling the Operator to redirect the database connection to unintended internal systems.\nThis flaw facilitates Server\u2011Side Request Forgery and can lead to misuse of valid stored credentials against internal services.", "risk_and_exploitability": "The vulnerability requires an authenticated Operator and leverages the web interface to modify an Enrichment Source.\nExploitation would allow the attacker to reach protected internal network hosts and use valid credentials, potentially leading to data exfiltration or lateral movement.\nNo EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a publicly known exploit does not eliminate the risk.\nThe CVSS score of 8.5 indicates a high severity, underscoring the potential for significant internal compromise when the Operator has sufficient permissions."}}}}, "created": "2026-04-27T19:30:12.042821+00:00", "title": "Logic Flaw in ODBC Enrichment Plugins Allows SSRF via Reused Credentials", "updated": "2026-04-27T20:21:10.016621+00:00", "vendors": ["guardsix", "guardsix$PRODUCT$odbc_enrichment_plugins"]}