PT-2026-47167 · Clash Verge Rev · Clash-Verge-Service-Ipc

Published 2026-06-06 · Updated 2026-06-06 · CVE-2026-26422

NVD

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2026-26422

Affected Products

Clash-Verge-Service-Ipc

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-26422 · Security Note
• https://github.com/clash-verge-rev/clash-verge-rev/commit/3bbcdbe5caacc2ffb713af69f2c93e202573f918 · Note
• https://github.com/clash-verge-rev/clash-verge-service-ipc/releases/tag/v2.3.0 · Note
• https://kaguranaku.me/posts/CVE-2026-26422 · Note