CVE-2026-66723 CERT.PL CVE debrief

Who should care

Defenders responsible for MWDB Core deployments, especially those with Remote Instances configured, should assess exposure and prioritize remediation. This includes verifying if MWDB Core deployments in your environment have Remote Instances configured and are vulnerable (versions >=2.2.0 and <2.19.0), assessing the potential impact of unauthorized actions on remote MWDB instances, and applying version 2.19.0 or later to fix the vulnerability.

Why it matters

CVE-2026-66723 is a high-severity vulnerability in MWDB Core that allows unauthenticated remote attackers to perform unauthorized actions on remote instances via the proxy API. Defenders should prioritize verifying exposure, especially in deployments with Remote Instances configured, and apply version 2.19.0 or later. The vulnerability's impact is limited to configured Remote Instances, and evidence is based on official CVE and NVD records.

• Potential unauthorized actions on remote MWDB instances via the proxy API.
• Possible exploitation of API keys for unauthorized access.
• Need for verification of Remote Instances configuration and vulnerability status.
• Prioritization of remediation based on deployment context and exposure.

Technical summary

The MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. This allows an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key, potentially leading to unauthorized actions on the remote instance. The vulnerability is limited to deployments where Remote Instances have been configured. This issue has been fixed in version 2.19.0. The CVE record and NVD entry provide details on the missing authorization vulnerability in MWDB Core versions >=2.2.0 and <2.19.0.

Defensive priority

Defenders should prioritize verifying exposure in MWDB Core deployments where Remote Instances have been configured, assessing the impact of unauthorized actions via the proxy API, and applying version 2.19.0 or later.

Recommended defensive actions

• Verify if MWDB Core deployments in your environment have Remote Instances configured and are vulnerable (versions >=2.2.0 and <2.19.0).
• Assess the potential impact of unauthorized actions on remote MWDB instances.
• Apply version 2.19.0 or later to fix the vulnerability.
• Review and update configurations for Remote Instances to ensure proper authorization and authentication mechanisms are in place.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the missing authorization vulnerability in MWDB Core versions >=2.2.0 and <2.19.0. The vulnerability allows unauthenticated remote attackers to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.