What is the CVSS score of CVE-2026-29044?

CVE-2026-29044 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by CVE-2026-29044?

Organizations using EVerest should be aware of moderate risk from CVE-2026-29044, a incorrect authorization vulnerability rated CVSS 5.0. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-29044?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest CVE-2026-29044

EUVD-2026-16230 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 GitHub_M

Authentication Bypass Everest Everest Core

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16230

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:37 nvd

MEDIUM 5.0

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines transaction_active=false and only calls withdraw_authorization_callback. This path ultimately calls Charger::deauthorize(), but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest EV charging software before version 2026.02.0 fails to properly stop charging transactions when authorization withdrawal occurs before the TransactionStarted event, allowing attackers with high privileges to bypass deauthorization through precise timing and maintain unauthorized charging sessions. The vulnerability stems from incomplete StopTransaction handling in the Charging state, affecting IoT and Everest Core deployments with no currently available patch.

Technical ContextAI

EVerest is an open-source EV charging software stack that manages the authorization and transaction lifecycle for electric vehicle charging sessions. The vulnerability resides in the AuthHandler component, which evaluates the transaction_active flag to determine whether to invoke withdraw_authorization_callback() or execute a full StopTransaction command. The root cause is classified under CWE-863 (Incorrect Authorization), where the authorization withdrawal logic fails to transition to a Charging state stop when the WithdrawAuthorization event is received during the pre-transaction phase. The affected product is specifically everest-core (CPE: cpe:2.3:a:everest:everest-core:*:*:*:*:*:*:*:*) in all versions before 2026.02.0. The race condition exploits a gap in the state machine where timing allows a charger to reach the Charging state despite the prior withdrawal signal, circumventing the intended authorization enforcement mechanism.

RemediationAI

Upgrade EVerest-core to version 2026.02.0 or later, which includes the upstream patch that ensures StopTransaction is executed regardless of transaction state when WithdrawAuthorization is processed (see GitHub Security Advisory GHSA-gx37-p775-qf5v at https://github.com/EVerest/EVerest/security/advisories/GHSA-gx37-p775-qf5v). Until patching is completed, implement network-level access controls to restrict which systems can initiate WithdrawAuthorization commands, limiting the authorization to trusted management systems only and logging all such events for audit purposes. Review charging session logs to identify any instances where authorization withdrawal occurred prior to transaction start events, which may indicate prior exploitation attempts.