CVE-2026-91842

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91842", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-15T08:29:14.348Z", "datePublished": "2026-09-15T15:00:09.823Z", "dateUpdated": "2026-09-15T15:48:10.869Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-15T15:00:09.823Z"}, "title": "OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "Deserialization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "Improper Input Validation"}]}], "affected": [{"vendor": "OpenBankProject", "product": "OBP-API", "versions": [{"version": "1.10.0", "status": "affected"}, {"version": "1.10.1", "status": "affected"}], "cpes": ["cpe:2.3:a:openbankproject:obp-api:*:*:*:*:*:*:*:*"], "modules": ["Kryo Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:N/AC:H/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-09-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-15T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-15T10:34:19.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ZAST.AI (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/404073", "name": "VDB-404073 | OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/404073/cti", "name": "VDB-404073 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-91842", "name": "CVE-2026-91842 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/933652", "name": "Submit #933652 | OpenBankProject OBP-API <=1.10.1 Deserialization of Untrusted Data", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenBankProject/OBP-API/issues/2888", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/OpenBankProject/OBP-API/security/advisories/GHSA-889g-wggr-jrrq", "tags": ["broken-link"]}, {"url": "https://github.com/OpenBankProject/OBP-API/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T15:48:03.770634Z", "id": "CVE-2026-91842", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T15:48:10.869Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-91842", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T15:48:03.770634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T15:48:08.065Z"}}], "cna": {"title": "OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization", "credits": [{"lang": "en", "type": "reporter", "value": "ZAST.AI (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:N/AC:H/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:openbankproject:obp-api:*:*:*:*:*:*:*:*"], "vendor": "OpenBankProject", "modules": ["Kryo Handler"], "product": "OBP-API", "versions": [{"status": "affected", "version": "1.10.0"}, {"status": "affected", "version": "1.10.1"}]}], "timeline": [{"lang": "en", "time": "2026-09-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-15T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-15T10:34:19.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/404073", "name": "VDB-404073 | OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/404073/cti", "name": "VDB-404073 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-91842", "name": "CVE-2026-91842 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/933652", "name": "Submit #933652 | OpenBankProject OBP-API <=1.10.1 Deserialization of Untrusted Data", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenBankProject/OBP-API/issues/2888", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/OpenBankProject/OBP-API/security/advisories/GHSA-889g-wggr-jrrq", "tags": ["broken-link"]}, {"url": "https://github.com/OpenBankProject/OBP-API/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "Deserialization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-15T15:00:09.823Z"}}}, "cveMetadata": {"cveId": "CVE-2026-91842", "state": "PUBLISHED", "dateUpdated": "2026-09-15T15:48:10.869Z", "dateReserved": "2026-09-15T08:29:14.348Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-15T15:00:09.823Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:openbankproject:obp-api:*:*:*:*:*:*:*:*"], "modules": ["Kryo Handler"], "product": "OBP-API", "vendor": "OpenBankProject", "versions": [{"status": "affected", "version": "1.10.0"}, {"status": "affected", "version": "1.10.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "id": "CVE-2026-91842", "lastModified": "2026-09-16T17:53:40.500", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.2, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-91842", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T15:48:03.770634Z", "version": "2.0.3"}}]}, "published": "2026-09-15T15:17:33.120", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/OpenBankProject/OBP-API/"}, {"source": "cna@vuldb.com", "url": "https://github.com/OpenBankProject/OBP-API/issues/2888"}, {"source": "cna@vuldb.com", "url": "https://github.com/OpenBankProject/OBP-API/security/advisories/GHSA-889g-wggr-jrrq"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-91842"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/933652"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/404073"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/404073/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-502"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.10.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.10.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OBP-API", "source": "cna", "vendor": "OpenBankProject"}, "product": "obp-api", "vendor": "openbankproject"}], "created": "2026-09-16T04:15:18.127261+00:00", "updated": "2026-09-20T17:00:13.369010+00:00", "vendors": ["openbankproject", "openbankproject$PRODUCT$obp-api"]}