PT-2026-29716 · Cesanta · Mongoose

The_Evilsocket · Published 2026-04-02 · Updated 2026-04-30 · CVE-2026-5246

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions prior to 7.21

Description A flaw in the P-384 Public Key Handler component, specifically within the mg tls verify cert signature() function of the mongoose.c file, allows for remote authorization bypass through manipulation.

Recommendations Update to version 7.21.

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-5246

JLSEC-2026-371

Affected Products

Mongoose

References · 13

• https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 · Patch
• https://github.com/cesanta/mongoose/releases/tag/7.21 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5246 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5246 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-371 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5246 · Vendor Advisory
• https://github.com/cesanta/mongoose · Note
• https://vuldb.com/vuln/354827 · Note
• https://evilsocket.net/2026/04/02/Mongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass · Reddit Post
• https://twitter.com/evilsocket/status/2039656380919886282 · Twitter Post
• https://github.com/advisories/GHSA-hm7q-jq63-pr78 · Note
• https://vuldb.com/vuln/354827/cti · Note
• https://vuldb.com/submit/770104 · Note