kronosnet CVE-2026-15812

Two specific non-default configuration conditions must both be present simultaneously: (1) kronosnet must be configured with dynamic link mode, meaning it is set to accept network traffic from any source IP address rather than a statically defined peer allowlist, and (2) network payload encryption must be explicitly disabled or left unconfigured. Both conditions are stated in the CVE description as prerequisites. Clusters that use kronosnet's built-in encryption (nss or gcrypt crypto backends) are fully protected regardless of link mode, because encryption provides implicit cryptographic packet authentication that the ACL bypass cannot circumvent. Clusters using static ACL peer IP lists instead of dynamic link mode are also not affected. Exploitation further requires that the attacker have network-layer access to the cluster's communication interfaces, which are typically on dedicated management or cluster networks rather than public-facing interfaces, providing an additional deployment-level barrier in well-segmented environments.

The CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L is well-calibrated for this flaw. AC:H correctly captures the dual configuration prerequisite - dynamic link mode and disabled encryption must both be present - which substantially narrows the real-world attack surface to deliberately relaxed or misconfigured deployments. The impact ceiling of I:L/A:L is consistent with data injection causing corruption or messaging instability rather than full host compromise; C:N confirms no confidentiality exposure. No EPSS score is available in the provided data, so probabilistic exploitation rate cannot be assessed. No CISA KEV listing and no POC are known, indicating no observed active exploitation or public weaponization. This is a genuine medium-priority issue for teams running unencrypted dynamic-link kronosnet clusters, but the AC:H constraint means well-hardened deployments using built-in encryption are entirely unaffected and can deprioritize emergency patching in favor of next scheduled maintenance.

An attacker with layer-3 network access to the cluster's dedicated communication interfaces identifies that the target kronosnet instance is running in dynamic link mode without encryption by observing unencrypted cluster traffic. The attacker constructs network frames embedding a spoofed link ID matching a legitimate cluster peer and transmits them to the cluster endpoint. Because the ACL subsystem accepts the link ID at face value without cryptographic verification, the injected frames pass into the application layer, where they may corrupt cluster state messages or destabilize corosync quorum, potentially causing failover events or node fencing. No public exploit code is known at time of analysis.