Pexip Infinity CVE-2026-103106

Exploitation requires the attacker to already be able to run arbitrary code on a Pexip Infinity node - either by first achieving remote code execution through a separate, unrelated vulnerability or by already possessing administrative access to the node's operating system. Given that foothold, the attacker sends improperly validated input to an internal Pexip Infinity service to escalate from a low-privileged local context to root. Limiting factors: this is local-only (AV:L), requires low privileges plus a pre-existing code-execution foothold (PR:L), and applies to Pexip Infinity versions before 38.2 and versions 39.0, 39.1, and 40.0. It is not remotely exploitable on its own and depends entirely on a prior compromise stage.

This is a genuine but conditional local privilege-escalation flaw, not a standalone remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) correctly reflects that exploitation requires an attacker to already have local, authenticated code-execution on a Pexip Infinity node - the description explicitly states the attacker must first achieve RCE via a separate vulnerability or already hold administrative OS access. The high 7.8 score is driven entirely by the root-level triple-H impact (C:H/I:H/A:H), not by ease of initial access. There is no EPSS score, no CISA KEV listing, and no public exploit code provided, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. In practical terms this is a second-stage/post-compromise escalation primitive rather than an internet-facing priority: it becomes dangerous only after an initial foothold exists. Real-world urgency is therefore moderate - patch it as part of the vendor's coordinated bulletin, but it does not represent independent remote-exploitation risk. Note: the 'RCE' tag is misleading, since RCE is a prerequisite the attacker must supply, not the outcome of this specific flaw.

An attacker who has already compromised a Pexip Infinity node - for example via a separate remote code execution bug or by holding administrative OS credentials - runs code as a low-privileged local user and feeds malformed input to an internal Pexip Infinity service that fails to validate it properly. This improper input validation lets the attacker cross a privilege boundary and escalate to root, gaining full control of the node. No public proof-of-concept exploit was identified in the provided intelligence.