CVE-2026-31983— Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Nozomi Networks | CMC | < 26.2.0 | affected |
| Nozomi Networks | Guardian | < 26.2.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-31983
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0
Source: CVE Program / CVE List V5
Vulnerability Description
A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH keys.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Nozomi Networks Guardian 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Nozomi Networks Guardian是美国Nozomi Networks公司的网络安全产品。 Nozomi Networks Guardian和Nozomi Networks CMC 26.2.0之前版本存在授权问题漏洞，该漏洞源于SSH密钥同步端点缺少身份验证，可能导致未经身份验证的攻击者获取已上传公共SSH密钥的用户列表、用户组以及公共SSH密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Nozomi Networks | Guardian | 0 ~ 26.2.0 | - | |
| Nozomi Networks | CMC | 0 ~ 26.2.0 | - |
II. Public POCs for CVE-2026-31983
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-31983
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-31983 (1)
Same Patch Batch · Nozomi Networks · 2026-07-09 · 6 CVEs total
| CVE-2026-31985 | 8.1 HIGH | Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the R |
| CVE-2026-33390 | 8.1 HIGH | Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 |
| CVE-2026-31984 | 7.5 HIGH | DoS through oversized audit log entries in Guardian/CMC before 26.2.0 |
| CVE-2026-31982 | 7.1 HIGH | Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0 |
| CVE-2026-31981 | 5.9 MEDIUM | HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0 |
IV. Related Vulnerabilities
Same product: Guardian
- CVE-2026-55734
guardian atom exhaustion in Guardian.Permissions.encode_perm - CVE-2026-55733
Atom-table exhaustion denial of service in Guardian permissi - CVE-2026-54894
Atom-table exhaustion denial of service in Guardian via unbo - CVE-2026-55735
Guardian.revoke/3 acts on unverified token claims, allowing - CVE-2026-33390
Incorrect privilege assignment for Arc sensors in Guardian/C
Same vendor: Nozomi Networks
- CVE-2026-33922
Path traversal in the Offline archives functionality of the - CVE-2026-33921
Npcap driver installed without administrator-only access res - CVE-2026-33390
Incorrect privilege assignment for Arc sensors in Guardian/C - CVE-2026-31985
Disabled and non-configurable TLS certificate validation in - CVE-2026-31984
DoS through oversized audit log entries in Guardian/CMC befo
Same weakness: CWE-306
- CVE-2026-56677
9Router: Authenticated Server-Side Request Forgery (SSRF) vi - CVE-2026-75479
JimuReport Unauthenticated Report Listing and Share Token Di - CVE-2026-75060
JetBrains PyCharm低于2026.2.1版本存在Jupyter MCP工具代码执行漏洞 - CVE-2026-71566
KubeVirt backend is not authenticated - CVE-2026-19971
LB-Link WR1210M Backup Endpoint backup.cgi main missing auth
V. Comments for CVE-2026-31983
No comments yet