Pexip Infinity CVE-2026-103105

Requires the attacker to already possess access to at least one node within a multi-node Pexip Infinity installation, from which they can reach the product-internal (inter-node) API of another node over the adjacent/management network. Exploitation targets the internal API's improper access control (CWE-863); it does not require authentication to that internal API (PR:N) or user interaction (UI:N), but the code executes only as an UNPRIVILEGED user on the target node. Limiting factors: an initial foothold on a node is a prerequisite (AV:A, not internet-wide), the installation must be multi-node for lateral impact to matter, and affected builds are Infinity before 38.2 plus 39.0/39.1/40.0.

This is a genuine high-priority issue but with an important scoping caveat. The CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects adjacent-network access with low complexity, no authentication, and no user interaction, yielding full CIA impact - consistent with remote code execution. The critical limiting factor is that the attacker must first have access to a node WITHIN a Pexip Infinity installation before reaching the vulnerable inter-node internal API; this is lateral movement / privilege-lateral spread, not an internet-facing unauthenticated RCE. Note the vector uses AV:A (Adjacent) while the description says 'local access to a node,' which is internally consistent: the attacker leverages a foothold on one node to reach the internal API of another over the management/inter-node network. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active exploitation or automated weaponization - the priority derives from impact and the RCE nature rather than from observed exploitation. The resulting code execution is as an UNPRIVILEGED user, which caps immediate impact and typically requires further local privilege escalation for full node compromise. Net: a real priority for defense-in-depth of Pexip deployments (it breaks the trust boundary between nodes), but not a drop-everything internet-perimeter emergency absent an initial foothold.

An attacker who has already compromised or gained local access to one node in a multi-node Pexip Infinity deployment (e.g., a Conferencing Node in a DMZ) sends crafted requests to the improperly access-controlled product-internal API exposed by a peer node. Because the API fails to enforce authorization, the request executes attacker-supplied code as an unprivileged user on that second node, enabling lateral movement across the installation. No public exploit code is identified at time of analysis.