Pandora FMS CVE-2026-30810

Requires valid authentication to Pandora FMS with low-privilege user account credentials (CVSS PR:L) - typically any monitoring user with access to the API Checker extension interface. Specific exploitation requires the API Checker extension to be enabled and accessible to the authenticated user's role, which is likely the default configuration for standard monitoring accounts. No user interaction required (UI:N). The vulnerability is exploitable from network-accessible positions (AV:N) without complex timing or race conditions (AC:L). Exploitation is NOT limited to specific non-default configurations; any standard Pandora FMS deployment running versions 777-800 with API Checker enabled is vulnerable. However, the impact is significantly constrained if the Pandora FMS server has restrictive egress firewall rules already in place, if cloud metadata endpoints use IMDSv2 (session-token based), or if monitored internal services require additional authentication beyond network reachability.

Real-world risk is MODERATE-HIGH with important context. CVSS 7.1 reflects network-accessible attack vector (AV:N) with low complexity (AC:L) but requires low-privileged authentication (PR:L), limiting exposure to credential holders. The vulnerability enables HIGH confidentiality impact (VC:H) and limited integrity/availability impacts (VI:L/VA:N), with scope change indicators (SC:L/SI:L) suggesting cross-trust-boundary access. No EPSS score available for probabilistic assessment. NOT in CISA KEV, indicating no confirmed widespread or targeted exploitation. No public POC identified at time of analysis. The privilege escalation path via SSRF is particularly concerning in cloud environments where metadata services can yield IAM credentials, or in segmented networks where the FMS server has broader access than user networks. Primary risk: authenticated insiders or compromised low-privilege accounts gaining access to sensitive internal APIs, configuration data, or cloud credentials. Lower priority than unauthenticated RCE, but critical for organizations using Pandora FMS to monitor privileged infrastructure or cloud resources.

An authenticated attacker with standard monitoring-user credentials logs into Pandora FMS and accesses the API Checker extension. By crafting malicious API target URLs pointing to internal infrastructure (e.g., http://192.168.1.10/admin, http://169.254.169.254/latest/meta-data/iam/security-credentials/), the attacker forces the FMS server to make requests on their behalf. The server returns responses containing sensitive configuration data, AWS temporary credentials, or internal service authentication tokens, which the attacker captures to escalate privileges and pivot deeper into the monitored environment. Publicly available exploit code exists status unknown.