CVE-2026-31151
Published: 06 April 2026
Summary
CVE-2026-31151 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Kaleris Yard Management Solutions. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-31151 is a critical authentication bypass vulnerability in the login mechanism of Kaleris Yard Management System (YMS) version 7.2.2.1. Published on April 6, 2026, the flaw, classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), enables attackers to circumvent login verification and gain unauthorized access to the application's resources. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its high severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Remote attackers require no authentication to exploit this issue over the network with minimal effort. Successful exploitation grants high-impact access, compromising confidentiality, integrity, and availability of the affected resources, potentially allowing full control over the YMS application.
Advisories and further details are available in the referenced sources, including a GitHub repository at https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-31151 documenting the CVE and the Kaleris product page at https://kaleris.com/solutions/yard-management/. Practitioners should consult these for mitigation guidance and patch information specific to Kaleris YMS deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19271
Vulnerability details
An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authentication bypass in network-accessible login mechanism of public-facing YMS application directly enables initial access via exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates robust identification and authentication for organizational users, directly preventing bypasses in the login mechanism exploited by this CVE.
Enforces logical access authorizations in accordance with policy, blocking unauthorized resource access resulting from authentication bypass.
Explicitly identifies and limits actions permitted without identification or authentication, mitigating CWE-288 alternate path bypasses like this vulnerability.