CVE-2026-71879

CVSS 9.1 (critical) · published 2026-08-18

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Weakness: CWE-288

Source: NVD CVE-2026-71879

References

• https://github.com/gbif/ipt/issues/3115
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md
• https://www.gbif.org/ipt

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.