Which versions of Rainbond are affected by CVE-2026-72741?

Rainbond versions through 6.9.7 contain a cross-tenant privilege escalation vulnerability affecting multi-enterprise deployments.

How to fix or mitigate CVE-2026-72741?

Within 24 hours: inventory all Rainbond instances, confirm deployed versions and multi-tenant configurations, and implement network-level access restrictions to limit API exposure. Within 7 days: deploy additional API validation layers (reverse proxy, WAF, or network segmentation) to restrict cross-tenant path traversal, enable enhanced logging on tenant-specific API calls, and audit active user roles for least-privilege compliance. Within 30 days: establish vendor communication to track patch timeline (no fix currently available), develop and test upgrade procedures for multi-tenant environments, and implement mandatory additional authentication factors for operations crossing tenant boundaries.

Rainbond CVE-2026-72741

Q: What is the CVSS score of CVE-2026-72741?

CVE-2026-72741 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-58190 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-13 disclosure@vulncheck.com

GHSA-5xhp-2v8r-m7wh

Authentication Bypass

8.6

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable IDOR requiring only a valid API token (PR:L, AC:L); no scope change as impact is bounded to the vulnerable enterprise's data, with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 18:32 vuln.today

CVE Published

Aug 13, 2026 - 18:18 cve.org

HIGH 8.6

DescriptionCVE.org

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

AnalysisAI

Cross-enterprise IDOR in Rainbond through 6.9.7 allows any authenticated user to read or modify another enterprise's resources by substituting an arbitrary tenant name in API URL paths. The CheckToken function validates token authenticity but never cross-checks that the token's enterprise matches the enterprise embedded in the request path, enabling horizontal privilege escalation across tenant boundaries. Impacted resources include services, plugins, environment variables, and TLS certificates belonging to any enterprise on the same Rainbond instance. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Rainbond is an open-source cloud-native application management platform (github.com/goodrain/rainbond) offering multi-enterprise, multi-tenant resource isolation. The vulnerable component is the region API's CheckToken middleware, which is responsible for authenticating inbound API requests. CWE-639 (Authorization Bypass Through User-Controlled Key) describes this class precisely: the tenant name embedded in URL paths is an attacker-controlled key that the server uses to route resource lookups, but the middleware never validates that the caller's enterprise identity matches the tenant name supplied in the path. This is an Insecure Direct Object Reference (IDOR) pattern at the enterprise boundary. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is consistent with a low-complexity, network-accessible horizontal privilege escalation. All Rainbond releases through version 6.9.7 are affected.

RemediationAI

No vendor-released patched version was confirmed in the available data at time of analysis. Administrators should monitor the upstream GitHub issue at https://github.com/goodrain/rainbond/issues/2665 and the VulnCheck advisory at https://www.vulncheck.com/advisories/rainbond-region-api-cross-enterprise-idor-via-tenant-access for patch availability. As a compensating control, operators running multi-enterprise deployments should immediately audit API access logs for cross-enterprise URL path substitution patterns (e.g., requests where the token-associated enterprise ID does not match the tenant name in the path). Network-level segmentation to restrict which users and systems can reach the region API reduces the attack surface. Until a fix is released, avoid deploying Rainbond in shared environments where enterprise data isolation is a hard security boundary; organizations with strict multi-tenancy requirements should treat this as a critical operational risk. Rolling back to a pre-6.9.7 version is not a viable mitigation as all versions through 6.9.7 are affected.