What is the CVSS score of CVE-2026-31215?

CVE-2026-31215 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of nexent are affected by CVE-2026-31215?

Nexent v1.7.5.2 contains a critical unauthenticated remote vulnerability (CVE-2026-31215) allowing attackers to delete arbitrary documents from ElasticSearch and MinIO storage without authentication.

How to fix or mitigate CVE-2026-31215?

Within 24 hours: Identify all Nexent v1.7.5.2 instances in your environment and immediately take them offline or restrict network access to trusted sources only. Within 7 days: Apply network segmentation-allow DELETE requests only from authenticated internal services; implement WAF rules to block DELETE /{index_name}/documents requests from untrusted networks. Within 30 days: Contact Nexent for patched version availability; if unavailable, evaluate migration to a patched alternative or implement API gateway authentication enforcement upstream of Nexent.

nexent CVE-2026-31215

EUVD-2026-29499 CRITICAL

Files or Directories Accessible to External Parties (CWE-552)

2026-05-12 mitre

GHSA-wm59-m58r-x983

Denial Of Service Information Disclosure Path Traversal Elastic N A

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 15:54 vuln.today

CVSS changed

May 13, 2026 - 15:52 NVD

9.1 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.1

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /{index_name}/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied path_or_url parameter. This allows unauthenticated remote attackers to send crafted requests that trigger the deletion of arbitrary documents from ElasticSearch indices and corresponding files from the MinIO storage system. Successful exploitation leads to data destruction and denial of service.

AnalysisAI

Remote unauthenticated attackers can delete arbitrary ElasticSearch documents and MinIO storage files in nexent v1.7.5.2 via the unprotected DELETE /{index_name}/documents endpoint. The backend service fails to authenticate requests or validate the path_or_url parameter, enabling mass data destruction and denial of service. EPSS probability (0.12%) indicates low predicted exploitation likelihood, and no active exploitation or public exploit code has been identified at time of analysis, though the CVSS 9.1 reflects the severe impact of unauthenticated remote data deletion.

Technical ContextAI

This vulnerability affects nexent's backend service integration with ElasticSearch and MinIO storage systems. The DELETE API endpoint processes user-supplied path_or_url parameters without authentication gates or input validation, corresponding to CWE-552 (Files or Directories Accessible to External Parties). The architecture appears to link ElasticSearch document deletion operations directly to MinIO file system operations, creating a cascading deletion effect. The vulnerable endpoint accepts index_name as a route parameter and likely uses the unvalidated path_or_url to construct file system paths, enabling path traversal attacks. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation requiring no authentication, low complexity, and no user interaction. MinIO typically serves as object storage for document management systems, meaning exploitation could delete both metadata (ElasticSearch) and actual file content (MinIO) in a single request.

RemediationAI

Upgrade nexent to a patched version once released by ModelEngine-Group - no vendor advisory with fix version identified at time of analysis. Monitor the GitHub repository (https://github.com/ModelEngine-Group/nexent) and vendor notification channels for security updates. As immediate compensating controls: (1) Restrict network access to the DELETE /{index_name}/documents endpoint using firewall rules or reverse proxy authentication to allow only trusted internal services (trade-off: requires architectural changes to inter-service authentication). (2) Implement network segmentation to prevent public internet access to nexent backend services, allowing access only from application frontend tiers (trade-off: may require VPN for administrative access). (3) Deploy Web Application Firewall (WAF) rules to block DELETE requests containing path traversal patterns like '../' or absolute paths in the path_or_url parameter (trade-off: bypassable if parameter encoding is used, provides defense-in-depth only). (4) Enable ElasticSearch and MinIO audit logging to detect unauthorized deletion attempts (detection only, not prevention). (5) Implement regular backup snapshots of ElasticSearch indices and MinIO storage with tested restoration procedures (recovery control, does not prevent initial data loss). Do not expose nexent backend APIs directly to untrusted networks.