PT-2026-41018 · Gradient · Gradient

Derdennisop · CVE-2026-44592 · Published 2026-05-14 · Updated 2026-05-14

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradient versions prior to 1.1.1

Description When the GRADIENT DISCOVERABLE variable is set to true, an unauthenticated user can register as a worker by sending a new worker UUID to the /proto endpoint. This allows the user to obtain a session with PeerAuth::Open permissions, enabling them to view jobs from all organizations and upload arbitrary store paths into nar storage and the cached path table using NarPush or NarUploaded functions.

Recommendations Update to version 1.1.1. Set the GRADIENT DISCOVERABLE variable to false to prevent unauthorized worker registration.

Exploit

Fix

Insufficient Verification of Data Authenticity

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-345

CWE-862

CWE-306

Related Identifiers

CVE-2026-44592

GHSA-49W6-GF3P-96M2

Affected Products

Gradient

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44592.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44592 · Security Note
• https://github.com/wavelens/gradient/security/advisories/GHSA-49w6-gf3p-96m2 · Note