PT-2026-41130 · Hedera · Hedera Guardian

Christ Bouchuen · CVE-2026-45248 · Published 2026-05-14 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hedera Guardian versions prior to 3.5.2

Description An authentication bypass exists in the 'GET /api/v1/demo/registered-users' endpoint. This allows unauthenticated attackers to retrieve sensitive user information, including usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

Recommendations Update to a version newer than 3.5.1. As a temporary workaround, restrict access to the 'GET /api/v1/demo/registered-users' endpoint to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-45248

Affected Products

Hedera Guardian

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45248.json · Exploit
• https://github.com/hashgraph/guardian/pull/6076 · Patch
• https://osv.dev/vulnerability/CVE-2026-45248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45248 · Security Note
• https://github.com/hashgraph/guardian · Note
• https://t.me/cveNotify/164926 · Telegram Post
• https://twitter.com/CVEnew/status/2055074211429781930 · Twitter Post
• https://t.me/CVEtracker/53850 · Telegram Post
• https://vulncheck.com/advisories/hedera-guardian-authentication-bypass-information-disclosure · Note