EUVD-2026-31131
GHSA-p3hw-qj46-c684
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Secure Workload API
-
DeliveryCraft request to internal REST endpoint
-
ExploitBypass authentication via CWE-306 flaw
-
ExecutionExecute call as Site Admin
-
PersistRead cross-tenant data and alter policy
-
ImpactWeaken segmentation for follow-on access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Cisco Secure Workload, requiring only network reachability to the cluster's REST API surface and the ability to send a crafted request to an affected internal endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms there is no authentication, user interaction, or non-default setting required, and scope is changed because the unauthenticated caller obtains Site Admin authority spanning tenants. The principal limiting factor is network exposure: deployments whose management/API plane is reachable only from a restricted operator network are materially harder to reach than those exposing the API surface to broader internal networks or the internet, though no platform, client, or version-specific gating beyond running an affected build is described. |
| Impact | All available signals point to maximum severity: CVSS 3.1 base score is 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - network reachable, low complexity, no privileges, no user interaction, scope-changed, and full confidentiality, integrity, and availability impact. CWE-306 (missing authentication) combined with REST API attack surface is highly automatable once an endpoint is identified, and the Site Admin / cross-tenant outcome makes technical impact total. EPSS is not provided in the input, KEV status is not listed, and no public PoC is referenced, so exploitation probability cannot be quantified from the data given; however, the trivial preconditions and the value of the target (a segmentation control plane) make this a top-tier patching priority regardless. No conflicting signals were observed between the CVSS vector and the description - both indicate unauthenticated remote exploitation. |
| Exploit ScenarioDerived | An attacker with network reachability to a Secure Workload cluster's API surface sends a crafted HTTP(S) request directly to one of the unauthenticated internal REST endpoints, bypassing the normal authentication layer. The request is processed with Site Admin authority, allowing the attacker to enumerate tenants, read sensitive policy and telemetry data, and push configuration changes - for example weakening or removing segmentation policy - across tenant boundaries. No public exploit has been identified at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means a working exploit, once written, would be trivially scriptable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to invoke internal REST API endpoints and act with Site Admin privileges across tenant boundaries. The flaw carries a maximum CVSS 10.0 score with a changed scope and full CIA impact, and no public exploit has been identified at time of analysis. Successful exploitation enables reading sensitive tenant data and modifying configuration globally, making this a critical-priority issue for any organization running affected versions.
RemediationAI
Patch available per vendor advisory - upgrade to the fixed Cisco Secure Workload release identified in cisco-sa-csw-pnbsa-g8WEnuy (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy); exact fixed version is not enumerated in the input data and should be taken from that advisory at upgrade-planning time. Until patching is complete, restrict network reachability to the Secure Workload management and API interfaces by allow-listing only trusted operator subnets and segmentation orchestrators at upstream firewalls or load balancers, which limits exposure of the vulnerable internal REST endpoints at the cost of breaking any out-of-band tooling that currently reaches the cluster from elsewhere. Enable and review API access logs for anomalous unauthenticated requests to internal endpoints and rotate Site Admin credentials and API tokens after upgrading, since pre-patch access could have produced persistent configuration changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Secure Workload (formerly Tetration) is Cisco's microsegmentation and workload protection platform that enforces zero-trust policy across data center and cloud workloads, exposing both customer-facing and internal REST APIs for management and telemetry. The root cause maps to CWE-306 (Missing Authentication for Critical Function): internal REST API endpoints fail to perform sufficient authentication and access validation, so requests reach privileged handlers without the caller having to prove identity. Because Secure Workload is multi-tenant, the absence of authentication on internal endpoints also collapses the tenancy boundary, letting a caller operate with the global Site Admin role rather than a scoped tenant role. The affected CPE is cpe:2.3:a:cisco:cisco_secure_workload across a wide range of 1.x through 4.x train builds enumerated in the EUVD record.
Know when Cisco Secure Workload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role.
This vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user.
Executive ViewAI
Cisco Secure Workload is vulnerable to a critical authentication bypass (CVSS 10.0) permitting unauthenticated remote attackers to gain Site Admin privileges and access sensitive tenant data across organizational boundaries. No public exploit identified at time of analysis. Successful exploitation enables unauthorized configuration modification and data exfiltration across all managed workloads, requiring immediate containment.
Network isolation of Secure Workload management interfaces to trusted internal networks only; deploy API gateway with request filtering and rate limiting on internal endpoints; enforce multi-factor authentication or additional authorization checks for Site Admin operations; implement comprehensive API request logging with real-time alerting for anomalous privilege escalation attempts; enforce network segmentation to restrict cross-tenant API communication; conduct daily access log analysis for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cisco Secure Workload
View allAuthentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromis
Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent a
Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neut
Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse imprope
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a
Exploit-DB