CVE-2026-90447

This CVE (CWE-290, authentication bypass by spoofing) describes a flaw in which a routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a request header that clients control. An authenticated low-privileged user who already holds the shared service credential can set that header so the request is steered onto the alternate path, where a fixed elevated role is applied instead of the primary role-based authorization check. As a result, the attacker can perform actions reserved for a higher-privileged role (CVSS 4.0 rates the integrity impact High, with no confidentiality or availability impact). The available data does not name the vendor or product, but CISA ICS-CERT assigned the identifier, indicating an industrial control system context; affected deployments are those in which low-privileged users know the shared service credential. No exploitation is currently known: the issue is not in CISA's KEV catalog and no public proof-of-concept exists.

What to do: No fixed versions are identified in the available data; monitor the CISA ICS-CERT advisory for the affected product and patch releases. As interim mitigation, restrict knowledge of the shared downstream-service credential to trusted users, and at a reverse proxy or gateway strip or override the client-supplied routing-selection header so it can only be set by trusted front-ends. Review authentication and audit logs for low-privileged accounts performing actions associated with the elevated role.