What is the CVSS score of EUVD-2026-28356?

EUVD-2026-28356 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Liderahenk are affected by EUVD-2026-28356?

Liderahenk 2.0.1 contains a critical access control bypass vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to achieve complete system compromise without authentication or user…. A patch is available.

How to fix or mitigate EUVD-2026-28356?

Within 24 hours: Identify all systems running Liderahenk 2.0.1 and isolate them from untrusted networks; consult vendor Pardus for patch availability and interim guidance. Within 7 days: Implement network-level access controls restricting Liderahenk administrative interfaces to trusted IP ranges only; enable enhanced logging and monitoring for unauthorized access attempts. Within 30 days: Upgrade to patched version when released by vendor; conduct full security audit of Liderahenk instances and review access logs for indicators of compromise.

Liderahenk EUVD-2026-28356

| CVE-2026-6508 CRITICAL

Origin Validation Error (CWE-346)

2026-05-07 iletisim@usom.gov.tr

GHSA-6j26-x548-mh3c

Information Disclosure

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 07, 2026 - 13:16 EUVD

Analysis Generated

May 07, 2026 - 12:45 vuln.today

CVE Published

May 07, 2026 - 12:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Liderahenk: from 2.0.1 before 2.0.2.

AnalysisAI

Remote unauthenticated attackers can bypass access control lists in Liderahenk 2.0.1, achieving complete system compromise with confidentiality, integrity, and availability impact. The origin validation flaw (CWE-346) allows attackers to access restricted functionality without proper authorization checks. CVSS 9.8 (Critical) reflects network-accessible exploitation requiring no authentication or user interaction. No EPSS data or CISA KEV status available, but the origin validation weakness combined with unrestricted network access creates high practical risk. Reported by Turkey's National Cyber Security Center (USOM), indicating potential targeting of Turkish government/organizational deployments.

Technical ContextAI

Liderahenk is an open-source centralized system and network management platform developed by TUBITAK BILGEM for enterprise IT environments. The vulnerability stems from CWE-346 (Origin Validation Error), meaning the application fails to properly verify the origin or source of requests before granting access to sensitive functionality. This typically occurs when authentication/authorization checks rely on easily-spoofed headers (X-Forwarded-For, Referer), client-supplied origin indicators, or missing Cross-Origin Resource Sharing (CORS) validation. In access control systems like Liderahenk, origin validation errors allow attackers to impersonate trusted sources or bypass ACL enforcement entirely by manipulating request metadata. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-based exploitation with low complexity and no prerequisites, suggesting the flaw exists in default configurations accessible via standard network protocols.

RemediationAI

Upgrade immediately to Liderahenk version 2.0.2 or later, which addresses the origin validation flaw per the version range specified in the CVE description (from 2.0.1 before 2.0.2). Consult the official USOM advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0181 for Turkish-language remediation guidance and download links. If immediate patching is not feasible, implement network segmentation to restrict Liderahenk management interfaces to trusted administrative networks only-block all internet-facing access and limit to VPN or internal IP ranges (trade-off: reduces remote administration flexibility). Deploy web application firewall (WAF) rules to enforce strict origin header validation and block requests with suspicious or missing origin metadata (trade-off: may cause false positives for legitimate automation or API clients). Review authentication logs for unauthorized access attempts to administrative functions, particularly from unexpected source IPs, as historical exploitation may have occurred undetected. No compensating controls fully mitigate the vulnerability-patching is the only complete solution.