Is there a public PoC exploit available for CVE-2026-91002?

Yes, a public proof-of-concept exploit is available for CVE-2026-91002. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-91002?

Yes, a patch is available for CVE-2026-91002. Update the affected software to the latest version immediately.

Maltrail CVE-2026-91002

Q: What is the CVSS score of CVE-2026-91002?

CVE-2026-91002 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

Q: Which versions of Maltrail are affected by CVE-2026-91002?

Unauthenticated access to the `/blacklist` endpoint of Maltrail (versions up to 3.0.1) allows any remote caller to retrieve source IP addresses of events that matched the operator's BLACKLIST rules,…. A patch is available.

EUVD-2026-78274 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-09-15 VulDB

GHSA-j5qh-4734-fxc3

Authentication Bypass Information Disclosure Maltrail

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication required (AV:N/PR:N); confidentiality impact is low as only flagged source IPs are disclosed, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 15, 2026 - 08:40 vuln.today

tag: Information Disclosure added

Source Code Evidence Fetched

Sep 15, 2026 - 08:24 vuln.today

Analysis Generated

Sep 15, 2026 - 08:24 vuln.today

CVSS changed

Sep 15, 2026 - 06:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Sep 15, 2026 - 05:30 cve.org

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.1 is able to resolve this issue. This patch is called d95868dff3da4d3bd4f942837a26cb7c73a797ae. It is suggested to upgrade the affected component. The vendor fixed the issue the same day it was reported, in version 3.1, by gating the endpoint on an authenticated session or the new Blacklist_ALLOWLIST option.

AnalysisAI

Unauthenticated access to the /blacklist endpoint of Maltrail (versions up to 3.0.1) allows any remote caller to retrieve source IP addresses of events that matched the operator's BLACKLIST rules, exposing internal network hosts flagged by the threat detection system. The oversight - a missing session check on one endpoint while all sibling endpoints (/events, /counts, /hunt, /meta, /geo) correctly required authentication - was confirmed by the vendor and patched in version 3.1 the same day it was reported. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The maltrail server's HTTP port must be network-reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) is well-calibrated for this vulnerability: it is trivially network-exploitable with no prerequisites, but the confidentiality impact is genuinely low, limited to a list of internal source IPs that maltrail has flagged - not credentials, session tokens, or application secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Maltrail version 3.1, which includes commit d95868dff3da4d3bd4f942837a26cb7c73a797ae available at https://github.com/stamparm/maltrail/releases/tag/3.1. … Detailed patch versions, workarounds, and compensating controls in full report.