CVE-2026-31309

Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2026-07-08

Updated

2026-07-16

Proof-of-concept exploits (1)

• Sch8ill/CVE-2026-313090★ · 2026-07-16

References

• CVE Record
• NVD entry

Related

• CVE-2026-31283
• CVE-2026-3133
• CVE-2026-31282
• CVE-2026-3134
• CVE-2026-31281
• CVE-2026-3135