{"id":28221,"date":"2026-09-24T04:31:55","date_gmt":"2026-09-23T20:31:55","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-84716"},"modified":"2026-09-24T04:31:55","modified_gmt":"2026-09-23T20:31:55","slug":"cve-2026-84716","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-84716","title":{"rendered":"CVE-2026-84716 [MEDIUM] &#8211; A flaw was found in the automation-controller instance\n                  install-bundle en"},"content":{"rendered":"<p>A flaw was found in the automation-controller instance<br \/>\n                  install-bundle endpoint. When a System Administrator downloads<br \/>\n                  an execution\/hop node&#8217;s install bundle, the controller signs an<br \/>\n                  X.509 certificate with the receptor mesh certificate authority<br \/>\n                  in which the Common Name, DNS subject-alternative-name, and<br \/>\n                  receptor node-id are taken verbatim from the caller-chosen<br \/>\n                  instance hostname, with a hard-coded ten-year validity, a random<br \/>\n                  serial, and no issuance log or revocation list. Because the<br \/>\n                  hostname charset validator is case-insensitive while the<br \/>\n                  uniqueness validator is case-sensitive, an administrator can<br \/>\n                  register a case variant of an existing control node&#8217;s hostname<br \/>\n                  and obtain a mesh-CA-signed certificate that TLS peers, which<br \/>\n                  match hostnames case-insensitively, accept as that control node.<br \/>\n                  In managed\/hosted deployments \u2014 where the customer holds<br \/>\n                  controller superuser but the platform operator runs the mesh \u2014<br \/>\n                  this yields a long-lived, non-revocable mesh peer credential and,<br \/>\n                  with an on-path position, TLS impersonation or interception of<br \/>\n                  control\/hybrid mesh nodes. It does not grant direct remote code<br \/>\n                  execution, because receptor work submission is gated by a<br \/>\n                  separate signing key not included in the bundle.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A flaw was found in the automation-controller instance<br \/>\n                  install-bundle endpoint. When a System Administrator downloads<br \/>\n                  an execution\/hop node&#8217;s install bundle, the co<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28221","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}