CVE-2026-54551 h44z CVE debrief

Who should care

Defenders responsible for managing WireGuard Portal instances, particularly those with low-privilege users, should assess exposure and prioritize verification and remediation efforts.

Why it matters

This vulnerability allows low-privilege users in WireGuard Portal to access sensitive information, potentially leading to privacy issues and unauthorized monitoring.

• Low-privilege users can enumerate peer public keys.
• Low-privilege users can monitor BytesReceived and BytesTransmitted values for peers belonging to other users.
• Interface names are exposed to low-privilege users.

Technical summary

The authenticated GET /api/v0/ws statistics WebSocket in WireGuard Portal versions 2.2.0 to 2.3.0 subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated and forwards every TrafficDelta event without per-user authorization, allowing low-privilege users to access sensitive information and potentially leading to privacy issues and unauthorized monitoring. This issue is fixed in version 2.3.0. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those with low-privilege users.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those with low-privilege users.

Recommended defensive actions

• Verify the version of WireGuard Portal being used and assess exposure to this vulnerability.
• Restrict access to the WebSocket API to prevent low-privilege users from enumerating peer public keys and monitoring traffic statistics.
• Upgrade to version 2.3.0 or later to fix the vulnerability.
• Monitor for any suspicious activity related to the WebSocket API.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is fixed in version 2.3.0. Defenders should verify the version of WireGuard Portal being used and assess exposure to this vulnerability. Evidence is limited to public CVE and NVD information, and further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.