CVE-2026-103105

Executive Summary

CVE-2026-103105 is an improper access control vulnerability (CWE-863) affecting Pexip Infinity deployments. An attacker who already holds local access to one node within a Pexip Infinity installation can abuse a product-internal API to execute arbitrary code as an unprivileged user on another node in the same installation. Because the access vector is adjacent and no privileges are required, the flaw primarily expands an attacker's reach laterally across a clustered video-conferencing infrastructure once a single node is compromised.

Technical Analysis

The root cause is improper access control enforced on a product-internal API. Per the NVD description, the vulnerability allows "an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node." Two properties define the mechanism:

1. Access-control defect on an internal API. CWE-863 (Incorrect Authorization) indicates the affected API fails to correctly restrict which callers may invoke its functionality. Because the API is described as "product-internal," its normal trust boundary is other nodes inside the same installation — the flaw lies in it accepting or acting on requests that should be rejected or restricted to more privileged origins.

2. Cross-node code execution. Successful abuse results in arbitrary code execution on a different node than the one the attacker already controls, under the context of an unprivileged user. This is a lateral movement and privilege-escalation-adjacent primitive within the installation's node mesh, not an initial-access vector by itself: the attacker must first obtain local access to one node.

Attack surface: the internal API exposed between nodes of a Pexip Infinity installation. The CVSS vector (AV:A) reflects that the attack originates from an adjacent network position — i.e., from a node within the installation rather than from the public internet.

No public proof-of-concept, exploit code, or Nuclei template is available. No CVE is listed in CISA KEV. The API endpoint names, authentication model, and data structures are not disclosed in the provided description; those specifics must not be assumed.

Exploitation Scenarios

No public PoC exists; the attack chain below is inferred strictly from the vulnerability class and the NVD description. Specific endpoint paths, request formats, and function names are intentionally omitted because they are not provided.

1. Reconnaissance / foothold. The attacker first needs local access to a node within a Pexip Infinity installation. This could be achieved through a separate compromise (e.g., an exposed management interface, a compromised service account, or physical/console access). The attacker then enumerates the installation's internal network and the node-to-node trust relationships.

2. Triggering the flaw. From the compromised node, the attacker sends requests to the product-internal API on another node. Because access control on that API is improper (CWE-863), the requests are not correctly authorized or are accepted from a caller that should not have the ability to invoke the sensitive functionality.

3. Execution. By invoking the improperly protected API functionality, the attacker causes code to execute on the target node as an unprivileged user. The exact method of obtaining code execution (e.g., command parameter passed to the API) is not described in the available data and is therefore not specified here.

4. Post-exploitation impact. The attacker now executes code on multiple nodes of the installation, enabling lateral movement, data access across the conferencing infrastructure, disruption of service, or establishment of a persistent foothold. The confidentiality, integrity, and availability impact of the CVSS vector are all High.

Impact Assessment

• Confidentiality (High): Code execution on additional nodes exposes data processed by those nodes, including conferencing metadata and potentially media/signaling context.
• Integrity (High): Attacker-controlled code can modify node state and services.
• Availability (High): Compromised nodes can be disrupted or disabled, degrading the video-conferencing platform.
• Blast radius: Scoped to a single Pexip Infinity installation — the flaw bridges from one compromised node to other nodes. It does not by itself provide initial internet-facing access.
• CVSS 8.8 (High). AV:A reflects the adjacent requirement; AC:L and PR:N indicate the API abuse requires no attacker privilege beyond the initial local foothold; UI:N means no user interaction.

Organizations running Pexip Infinity for critical real-time communications should treat node compromise as high-impact, since the platform often carries sensitive meeting content and integrates with identity and directory systems.

Detection Guidance

Sigma Rule

title: Suspicious Internal API Abuse Attempts Within Pexip Infinity Installation
id: 9b1f2a44-7c3e-4d5a-9f6e-pexip-internal-api
status: experimental
description: Detects anomalous process execution or API interaction on a Pexip Infinity node consistent with improper access control abuse (CVE-2026-103105).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103105
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_exec:
    type: EXECVE
    exe|endswith:
      - '/sh'
      - '/bash'
  selection_parent:
    ppid|contains: 'pexip'
  condition: selection_exec and selection_parent
falsepositives:
  - Legitimate administrative scripts run by Pexip services
level: high
tags:
  - attack.lateral_movement
  - attack.t1210

YARA Rule

rule CVE_2026_103105_Pexip_Internal_API_Abuse
{
    meta:
        description = "Heuristic detection of artifacts associated with improper access control abuse on Pexip Infinity internal API (CVE-2026-103105)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103105"
        severity = "high"
    strings:
        $pexip = "pexip" ascii nocase
        $infinity = "infinity" ascii nocase
        $api = "/internal" ascii nocase
        $exec = "system(" ascii
    condition:
        uint16(0) == 0x7f45 and 2 of ($pexip, $infinity, $api, $exec)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-103105 Possible Pexip Infinity Internal API Abuse - Cross-Node Request"; flow:established,to_server; content:"/internal"; http_uri; nocase; content:"Pexip"; http_header; nocase; threshold: type both, track by_src, count 20, seconds 60; classtype:attempted-admin; sid:2026103105; rev:1; reference:cve,2026-103105;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and process.parent.name : "*pexip*" and url.path : "/internal*" ]
  [ process where event.type == "start" and process.parent.name : "*pexip*" ]

Splunk SPL Query

index=* (process_name=sh OR process_name=bash) parent_process_name=*pexip*
| stats count min(_time) as firstTime max(_time) as lastTime by host, parent_process_name, process_name, user
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="pexip,cve-2026-103105,">
  <rule id="103105" level="12">
    <if_sid>100000</if_sid>
    <field name="parent_process">pexip</field>
    <match>sh|bash|system\(</match>
    <description>CVE-2026-103105: Possible arbitrary code execution via Pexip Infinity internal API abuse</description>
    <mitre>
      <id>T1210</id>
    </mitre>
    <group>attack.lateral_movement,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Enforce strict network segmentation so that nodes cannot freely reach each other's internal APIs beyond what is operationally required; apply least-privilege firewall rules between nodes.
   • Restrict and monitor local access to Pexip Infinity nodes (management interfaces, console, SSH) since a foothold on one node is the prerequisite for exploitation.
   • Rotate credentials and keys used for node-to-node communication if node compromise is suspected.
   • Monitor internal traffic to and from the internal API and alert on unexpected cross-node calls, especially those invoking execution functionality.

2. Patch / upgrade steps

   • No patch evidence is available from tracked sources. Verify directly with the vendor (Pexip) for the fixed release corresponding to the "before 38.2, plus 39.0, 39.1 and 40.0" reference in the NVD description, then upgrade affected nodes to the corrected build.
   • Treat this as unpatched until a vendor-confirmed fixed version is validated in-house; do not assume remediation from third-party summaries alone.

3. Long-term hardening

   • Apply defense-in-depth around internal APIs: authenticate and authorize all node-to-node calls, and reject requests from unintended origins.
   • Run node services under least-privilege accounts to limit the impact of arbitrary code execution.
   • Maintain continuous monitoring and logging across all nodes, with centralized correlation to detect lateral movement quickly.
   • Include Pexip Infinity nodes in vulnerability management and incident-response playbooks for clustered/adjacent-network exposure.

References

• NVD — CVE-2026-103105: https://nvd.nist.gov/vuln/detail/CVE-2026-103105
• Pexip — vendor security advisories/documentation: https://www.pexip.com/
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1210 — Exploitation of Remote Services: https://attack.mitre.org/techniques/T1210/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-103105 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are available for this CVE at the time of writing.