CVE-2026-102117
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-102117 is a high-severity Reliance on Untrusted Inputs in a Security Decision (CWE-807) vulnerability in Githubusercontent (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-17 (Remote Access) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-90302
Vulnerability Data
On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could…
more
then have operating-system commands executed on the node and receive their output, potentially resulting in remote code execution with the privileges of a local service account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V3.5.3V10.6.2V15.2.4
Mitigating Controls (NIST 800-53 r5) AI
AC-17 mandates documented restrictions and authentication requirements for remote access, blocking channels whose origins are not properly verified.
Explicitly requires that every access decision be based on authoritative, protected decision data rather than caller-supplied inputs.
Access enforcement requires decisions to be made from trusted policy data rather than modifiable client-supplied inputs.
Information-flow enforcement applies rules to validated, internal attributes instead of untrusted external values.
IA-3 requires unique identification and authentication of devices before any communication channel is established, directly stopping acceptance of unverified origins.
SC-23 protects session authenticity, ensuring the source of an established communication channel is verified and cannot be spoofed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper management of identities/credentials reduces the chance that security decisions will be driven by untrusted inputs.
Strong authentication mechanisms directly prevent security decisions from depending on modifiable, untrusted inputs.
Verification and protection of identity assertions stops reliance on attacker-controlled values for authorization decisions.
Policy-driven, least-privilege authorization reduces opportunities to bypass controls via tampered inputs.
Network protections reduce unauthorized channel usage but do not specifically require origin verification at channel setup.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Monitoring can detect exploitation but does not stop the underlying weakness.
Network security controls enforce source verification and channel authentication for incoming communications.
Security of network services includes validating the origin of service requests and connections.
Network segregation limits exposure but does not directly verify source of individual channels.
Cryptography can support channel authentication but does not inherently verify source without proper implementation.
Application security requirements explicitly call for validation of inputs used in security decisions.