Which versions of Meshery are affected by CVE-2026-65919?

Meshery versions before 1.0.57 contain an unauthenticated arbitrary file read vulnerability (CVSS 8.7) that allows remote attackers to download any file from affected systems without credentials or…. A patch is available.

Is there a public PoC exploit available for CVE-2026-65919?

Yes, a public proof-of-concept exploit is available for CVE-2026-65919. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-65919?

Within 24 hours, inventory all Meshery instances to identify those running versions prior to 1.0.57 and document what sensitive data resides on or is accessible through those systems. Within 7 days, apply the vendor-released patch (Meshery v1.0.57 or newer) to all affected instances after validation in a staging environment to confirm compatibility. Within 30 days, review system access logs for signs of exploitation of the affected /api/system/fileView and /api/system/fileDownload endpoints, conduct a sensitive data exposure assessment of potentially compromised systems, and implement network-level access restrictions limiting direct API access to Meshery if not already enforced.

Meshery CVE-2026-65919

Q: What is the CVSS score of CVE-2026-65919?

CVE-2026-65919 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-48342 HIGH

Path Traversal (CWE-22)

2026-07-23 VulnCheck

GHSA-2x9h-mj6j-c376

Path Traversal Suse Meshery

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity file read with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is confidentiality-only (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 18:21 vuln.today

Analysis Generated

Jul 23, 2026 - 18:21 vuln.today

CVE Published

Jul 23, 2026 - 17:39 cve.org

HIGH 8.7

DescriptionCVE.org

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

AnalysisAI

Unauthenticated arbitrary file read in Meshery before 1.0.57 lets remote attackers retrieve any file on the host by abusing the /api/system/fileView and /api/system/fileDownload endpoints, which pass a user-controlled file parameter straight to os.Open with no path validation. Reported by VulnCheck and fixed in v1.0.57, it carries a CVSS 4.0 score of 8.7 and requires no authentication or user interaction; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact vulnerable code path.

Technical ContextAI

Meshery is an open-source cloud-native management plane for service meshes and Kubernetes, commonly run as a self-hosted server exposing a REST/HTTP API. The flaw is a classic CWE-22 path traversal: two Go HTTP handlers accept a 'file' request parameter and hand it directly to os.Open without canonicalizing the path, checking for '..' traversal sequences, or constraining reads to an intended base directory. Because Go's os.Open honors both absolute paths (e.g. /etc/passwd) and relative traversal (e.g. ../../), any string the attacker supplies is resolved against the filesystem with the privileges of the Meshery server process. The CPE cpe:2.3:a:meshery:meshery:*:*:*:*:*:*:*:* confirms the Meshery application itself is affected across versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade to Meshery v1.0.57 or later, which adds path-traversal prevention in the file handlers (commit ea83a26cb090b13be36c07cf24a99f8c637cc765, PR #20133). If immediate upgrade is not possible, restrict network exposure of the Meshery server by binding it to localhost or placing it behind an authenticating reverse proxy, and block or filter external access to the /api/system/fileView and /api/system/fileDownload endpoints at the ingress/WAF layer - noting that blocking these paths may disable legitimate in-product file view/download features. Additionally, run the Meshery process under a least-privileged account so that even a successful read is limited to files that account can access. Consult the vendor advisory (https://github.com/meshery/meshery/releases/tag/v1.0.57) and the VulnCheck advisory for details.