Which versions of Arelle are affected by EUVD-2026-27079?

Arelle webserver versions prior to 2.39.10 contain a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary Python code through malicious plugin URLs,…. A patch is available.

How to fix or mitigate EUVD-2026-27079?

Within 24 hours: Inventory all Arelle webserver deployments and identify instances running versions prior to 2.39.10; disable network access to the /rest/configure endpoint if immediate patching is not possible. Within 7 days: Update all Arelle webserver instances to version 2.39.10 or later. Within 30 days: Conduct log review of the /rest/configure endpoint for suspicious plugin URL submissions dating back 90 days; assess whether any unauthorized code execution occurred.

Arelle EUVD-2026-27079

Q: What is the CVSS score of EUVD-2026-27079?

EUVD-2026-27079 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-42796 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-04 VulnCheck

Authentication Bypass Python RCE

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 04, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

May 04, 2026 - 18:22 NVD

9.8 (CRITICAL) 9.2 (CRITICAL)

Source Code Evidence Fetched

May 04, 2026 - 18:01 vuln.today

Analysis Generated

May 04, 2026 - 18:01 vuln.today

Analysis Generated

May 04, 2026 - 17:45 vuln.today

Patch released

May 04, 2026 - 17:45 nvd

Patch available

CVE Published

May 04, 2026 - 17:19 nvd

CRITICAL 9.2

DescriptionCVE.org

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

AnalysisAI

Remote code execution in Arelle webserver (versions prior to 2.39.10) allows unauthenticated attackers to execute arbitrary Python code by submitting malicious plugin URLs to the /rest/configure endpoint. The vulnerability stems from the webserver's plugin manager accepting and executing external Python files without authentication or URL validation. A patch is available in version 2.39.10 (GitHub PR #2320). CVSS 9.8 with network vector, no privileges required, and EPSS data not provided. No CISA KEV listing or confirmed active exploitation at time of analysis.

Technical ContextAI

Arelle is an open-source platform for XBRL (eXtensible Business Reporting Language) processing, commonly used for financial reporting validation and analysis. The vulnerability exists in Arelle's built-in REST API webserver component, specifically the /rest/configure endpoint that interfaces with the plugin management system. According to CWE-306 (Missing Authentication for Critical Function), the endpoint fails to implement authentication or authorization checks before processing the plugins query parameter. When an attacker-supplied URL is provided, the plugin manager uses Python's native capabilities to fetch and execute the remote .py file within the Arelle process context, inheriting all privileges of the running webserver instance. The affected CPE indicates this impacts the core Arelle application (cpe:2.3:a:arelle:arelle) across all versions before 2.39.10. GitHub PR #2320 titled 'Restrict Webserver Plugins' implemented the fix by adding authentication requirements and validating plugin sources before execution.

RemediationAI

Upgrade to Arelle version 2.39.10 or later, which implements authentication and plugin source restrictions per GitHub PR #2320 (https://github.com/Arelle/Arelle/pull/2320). Download the patched release from https://github.com/Arelle/Arelle/releases/tag/2.39.10. For environments unable to immediately upgrade, implement network-level access controls to restrict the /rest/configure endpoint to trusted IP ranges only - use firewall rules or reverse proxy ACLs to block external access to all /rest/* paths. Note this workaround prevents legitimate remote REST API usage and may break automation workflows. Alternatively, disable the Arelle webserver component entirely and migrate to CLI-based processing if REST API functionality is not business-critical. Monitor webserver logs for suspicious POST/GET requests to /rest/configure with plugins parameters, particularly URLs pointing to external domains or IP addresses. Review existing plugin configurations to ensure no unauthorized plugins were installed prior to patching.