What is the CVSS score of CVE-2026-5140?

CVE-2026-5140 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pardus are affected by CVE-2026-5140?

TUBITAK BILGEM Pardus versions prior to 0.8.0 contain an authentication bypass vulnerability (CVE-2026-5140, CVSS 8.8) that enables remote attackers to circumvent access controls, potentially…. A patch is available.

How to fix or mitigate CVE-2026-5140?

Within 24 hours, inventory all systems running vulnerable Pardus versions (prior to 0.8.0) and assess their network exposure and criticality. Within 7 days, apply the vendor-released patch (Pardus 0.8.0) to all affected systems, beginning with production and internet-facing instances. Within 30 days, confirm patch deployment across all inventory, enable authentication-related logging and monitoring, and review authentication architectures for similar CRLF-injection weaknesses.

Pardus CVE-2026-5140

EUVD-2026-26228 HIGH

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-04-29 TR-CERT

Authentication Bypass Pardus Tubitak Bilgem Software Technologies Research Institute

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable CRLF injection needing no privileges but requiring victim interaction (UI:R); authentication bypass yields high confidentiality and integrity impact, with availability accepted per vendor vector though not fully explained.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:56 vuln.today

Patch released

May 04, 2026 - 14:16 nvd

Patch available

Severity Changed

Apr 29, 2026 - 15:22 NVD

CRITICAL HIGH

CVSS changed

Apr 29, 2026 - 15:22 NVD

9.6 (CRITICAL) 8.8 (HIGH)

Patch available

Apr 29, 2026 - 15:02 EUVD

EUVD ID Assigned

Apr 29, 2026 - 14:00 euvd

EUVD-2026-26228

CVE Published

Apr 29, 2026 - 13:02 nvd

HIGH 8.8

DescriptionCVE.org

Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus allows Authentication Bypass.

This issue affects Pardus: from <=0.6.4 before 0.8.0.

AnalysisAI

Authentication bypass in TUBITAK BILGEM Pardus (versions <=0.6.4 up to 0.8.0) stems from improper neutralization of CRLF sequences, letting remote attackers manipulate protocol/header handling to circumvent authentication controls when a user is lured into triggering the crafted request. Reported by TR-CERT, the flaw carries a CVSS 8.8 with total technical impact per CISA SSVC, though EPSS is very low (0.05%, 17th percentile) and there is no public exploit identified at time of analysis. A vendor patch (0.8.0) is available.

Technical ContextAI

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences, 'CRLF Injection'), where untrusted input containing carriage-return/line-feed characters is passed into a context - typically HTTP headers or a line-oriented protocol - without sanitization. Injected CRLF sequences let an attacker split or forge header/response boundaries, which in this case is leveraged to defeat authentication logic. The affected component is TUBITAK BILGEM Pardus (cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus), developed by Turkey's national research institute; the CPE is wildcarded to all versions, with EUVD constraining the impacted range to Pardus <=0.6.4 before 0.8.0. CRLF-driven authentication bypasses generally arise when header values or session/redirect fields are constructed from user input, allowing the attacker to inject control data that the parser treats as authoritative.

RemediationAI

Vendor-released patch: upgrade Pardus to version 0.8.0 or later, which is the fixed release ending the affected <=0.6.4-to-<0.8.0 range; this is the primary and recommended remediation. Consult the TR-CERT/USOM advisory (https://www.usom.gov.tr/bildirim/tr-26-0131 and https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0131) and VulDB (https://vuldb.com/vuln/360147) for release specifics. If immediate upgrade is not possible, apply compensating controls tailored to CRLF injection: place the affected service behind a reverse proxy or WAF configured to reject requests containing encoded CR (%0d) or LF (%0a) in header-influencing parameters, and enforce strict input validation/normalization that strips CR/LF from any user-controlled value used in headers, redirects, or authentication flows - with the trade-off that overly aggressive filtering may break legitimate multi-value or encoded inputs. Because exploitation requires user interaction, also reduce exposure by restricting network access to the authentication interface to trusted networks and warning users against following untrusted links to the application, accepting the trade-off of reduced accessibility for remote/untrusted users.