CVE-2026-103106
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-103106 is a high-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Pexip Infinity (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-89583
Vulnerability Data
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able…
more
to run arbitrary code on a node by either achieving remote code execution via some other vulnerability or having administrative access to the operating system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Enforces logical access authorizations that limit resource transfers to only approved sphere crossings.
Enforces approved information flow authorizations between system components and connected systems, directly stopping improper resource transfers across spheres.
Separates user functionality from system management functions to avoid improper resource or behavior transfer between privilege spheres.
Prevents unintended information leakage through shared system resources when crossing sphere boundaries.
Monitors and controls communications at external and key internal boundaries to block unauthorized transfers between trust domains.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege authorization policies directly constrain resource transfers across security domains.
Protecting data-in-transit can limit exposure during inter-sphere transfers but does not address control-flow or authorization errors.
Logical segmentation and access controls reduce unintended cross-sphere resource movement.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information-transfer rules can prevent improper resource hand-off between spheres.
Access-control policies limit unintended control over transferred resources.
Managing access rights reduces risk of unauthorized resource transfer.
Network-security controls can block improper cross-sphere transfers.
Network segregation directly limits unintended resource movement between spheres.
Secure SDLC practices can catch incorrect resource-transfer flaws early.