Cyber Resilience

CVE-2026-41308

MediumUpdated

Published: 08 May 2026

Published
08 May 2026
Modified
05 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0012 31.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41308 is a medium-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Apnotic Password Pusher. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under…

more

certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.

CWE(s)
CWE-288NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Authentication bypass in public-facing web app (CWE-288) directly enables exploitation of the exposed Password Pusher service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

apnotic
password pusher
≤ 1.69.3 · 2.0.0 — 2.4.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-17 Remote Access
addresses: CWE-288

Authorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.

AC-9 Previous Logon Notification
addresses: CWE-288

Users can identify logons via alternate paths or channels by reviewing the previous logon time.

IA-10 Adaptive Authentication
addresses: CWE-288

Adaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.

IA-13 Identity Providers and Authorization Servers
addresses: CWE-288

Centralized IdPs close alternate authentication paths that enable bypass.

IA-8 Identification and Authentication (Non-organizational Users)
addresses: CWE-288

Enforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.

SC-11 Trusted Path
addresses: CWE-288

Requires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.

References