What is the CVSS score of CVE-2026-31309?

CVE-2026-31309 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Mysterium Node are affected by CVE-2026-31309?

Mysterium Node before v1.36.0 contains a critical authorization bypass in the TequilAPI management interface allowing unauthenticated remote attackers to achieve complete node takeover.

How to fix or mitigate CVE-2026-31309?

Within 24 hours: Identify all Mysterium Node instances in your environment and confirm which versions are below v1.36.0; determine if TequilAPI endpoints are exposed to untrusted networks. Within 7 days: Implement immediate firewall rules restricting access to the TequilAPI endpoint (default port 4050) to trusted internal networks only, or disable the endpoint entirely if remote management is not operationally required. Within 30 days: Upgrade all affected nodes to v1.36.0 or later once vendor confirmation of the patch is obtained; audit node configurations for unauthorized changes and deploy a staged upgrade plan to minimize operational disruption.

Mysterium Node CVE-2026-31309

EUVD-2026-42495 CRITICAL

Missing Authorization (CWE-862)

2026-07-08 cve@mitre.org

GHSA-p7gf-g6r8-g65h

Authentication Bypass

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Endpoint enforces no authorization so PR:N/AC:L, exploitable over the network with a single POST (AV:N/UI:N); config overwrite yields full node control, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 13:28 vuln.today

Analysis Updated

Jul 16, 2026 - 13:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 16, 2026 - 13:22 vuln.today

cvss_changed

Severity Changed

Jul 16, 2026 - 13:22 NVD

HIGH CRITICAL

CVSS changed

Jul 16, 2026 - 13:22 NVD

7.5 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 09, 2026 - 16:42 vuln.today

CVSS changed

Jul 09, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jul 08, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node before v1.36.0 allows unauthenticated attackers to arbitrarily overwrite the node's configuration and achieve a full node takeover via supplying a crafted POST request.

AnalysisAI

Full node takeover in Mysterium Node before v1.36.0 is possible because the /tequilapi/config/user endpoint enforces no authorization (CWE-862), letting remote unauthenticated attackers submit a crafted POST request to arbitrarily overwrite the node's configuration. Because the local TequilAPI management interface shipped enabled and unsecured by default, an attacker who can reach the API can seize complete control of the node. Publicly available exploit code exists (sch8ill/CVE-2026-31309), though there is no CISA KEV listing and EPSS remains low at 0.34%.

Technical ContextAI

Mysterium Node is the Go-based daemon of the Mysterium Network decentralized/peer-to-peer VPN, exposing a local management and control REST interface called TequilAPI. The root cause is CWE-862 (Missing Authorization): the router's access-control whitelist (tequilapi/tequil/routes.go, UnprotectedRoutes) and the mobile bootstrap defaults left configuration endpoints reachable without authentication. Source evidence shows the fix flipped mobile defaults so TequilAPI is enabled only when secured (options.TequilapiSecured = true, and nodeOptions.TequilapiEnabled = options.TequilapiSecured), meaning earlier builds enabled the API without requiring credentials. The /config/user endpoint writes user-controlled configuration, so unauthorized writes translate directly into control over how the node runs, effectively a takeover primitive.

RemediationAI

Vendor-released patch: upgrade to Mysterium Node v1.36.0 or later (https://github.com/mysteriumnetwork/node/releases/tag/1.36.0), which secures TequilAPI by default and closes the unauthorized configuration write; the relevant fix commits are 83051199cd641dd4ed9057b958e5616df1309f19 and bc099fcaff59fee9c8a8f8e07ffff5b3c5df2bb9. If you cannot upgrade immediately, do not expose the TequilAPI port to untrusted networks: bind it to localhost/127.0.0.1 only and place a host firewall rule restricting the API port to trusted management hosts, accepting that remote management tooling will lose direct access. Where TequilAPI authentication is configurable, enable it and set strong credentials before re-enabling the interface. Validate any change against configuration monitoring, since the trade-off of loopback-only binding is loss of remote/mobile control convenience.