CVE-2026-107492

waiting for further signals

GHSA-3ggw-c6vq-3x87 ↗

no check availablenot proven exploitable

awaiting cvepublic pockev

envoyproxy envoy <= 1.38.0

CWE-287 Improper Authentication

ETK-2026-3686, permanent identifier

cvss10.0cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

7h 42msince last run

2mAI analysis

timeline

0 = cve.org, not yet published

waiting for further signals−7h42mtrigger signal −5h38m

−4h

−2h

description

The supplied CVE record is marked REJECTED, and the evidence does not establish a vulnerability affecting Envoy. No attacker capability, affected-version range, or precondition can be determined from the available material.

mitigation

Treat this record as unconfirmed and verify its rejected status in your vulnerability-tracking process. Monitor authoritative Envoy security advisories for a corrected or replacement record before taking version-specific action.

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

cve.org record, t = 0

not published yet

Δ to public poc

–

Δ to kev

–

outcome

Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-06 00:43Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-107492

this entry in the feed

GET /api/v1/feed/CVE-2026-107492

{
  "etk_id": "ETK-2026-3686",
  "cve_id": "CVE-2026-107492",
  "display_id": "CVE-2026-107492",
  "ghsa_id": "GHSA-3ggw-c6vq-3x87",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Envoy vulnerability details not established",
  "summary": "The supplied CVE record is marked REJECTED, and the evidence does not establish a vulnerability affecting Envoy. No attacker capability, affected-version range, or precondition can be determined from the available material.",
  "mitigation": "Treat this record as unconfirmed and verify its rejected status in your vulnerability-tracking process. Monitor authoritative Envoy security advisories for a corrected or replacement record before taking version-specific action.",
  "vendor": "envoyproxy",
  "product": "envoy",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.38.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "envoy",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 2.07007855,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T00:43:07.699000+00:00",
      "days": -0.23506480688657408,
      "is_lower_bound": true,
      "measured_at": "2026-11-06T06:21:37.395539+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107492"
    }
  }
}

published 2026-11-06 00:54Z
last change 2026-11-06 06:13Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.