PT-2026-39010 · Unknown · Password Pusher

Pyuysig · Published 2026-05-08 · Updated 2026-05-08 · CVE-2026-41308

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Password Pusher versions prior to 1.69.3 Password Pusher versions prior to 2.4.2

Description An issue in the generic JSON API create path allows unauthenticated users to create file-type pushes under certain configurations, bypassing the intended authentication boundary.

Recommendations Update to version 1.69.3. Update to version 2.4.2.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-41308

Affected Products

Password Pusher

References · 5

• https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c · Vendor Advisory
• https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4 · Patch
• https://github.com/pglombardo/PasswordPusher/pull/4381 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41308 · Security Note
• https://twitter.com/CVEnew/status/2052767581069877588 · Twitter Post