Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0
An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.
CVE-2026-33388
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-33388
Guardian
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
CMC
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Nozomi Networks",
"product": "Guardian",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Nozomi Networks",
"product": "CMC",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-33388
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28327 · Revision 1
- Added to Heist Feed
- Publisher date