CVE-2026-103105 in Infinity
Summary
by MITRE • 09/30/2026
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in Pexip Infinity versions prior to 38.2, including the 39.0, 39.1, and 40.0 releases, represents a critical failure in access control mechanisms within product-internal application programming interfaces. This flaw allows an attacker who has achieved local access to any single node within a Pexip Infinity deployment to escalate privileges or execute arbitrary code on other nodes in the cluster. The core issue stems from insufficient validation of authorization tokens and session contexts when handling internal API requests, effectively bypassing intended isolation boundaries between distinct virtual machines or containers that comprise the distributed system architecture.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Control. In typical enterprise deployments, Pexip Infinity nodes are designed to operate with specific privilege levels and network segmentation to limit lateral movement in the event of a compromise. However, due to the improper access control flaw, an authenticated local user on one node can craft malicious API requests that are accepted by other nodes without proper verification of whether the requesting entity has permission to perform such actions remotely or across boundaries. This breakdown in trust assumptions enables cross-node command execution as an unprivileged user, which may subsequently be leveraged for further privilege escalation depending on the specific configuration and running services on the target node.
The operational impact of this vulnerability is severe due to its potential to facilitate lateral movement within a video conferencing infrastructure. An attacker with local access could exploit this flaw to disrupt service availability by crashing critical processes, exfiltrate sensitive meeting data or credentials stored in memory or temporary files, and establish persistent backdoors on multiple nodes simultaneously. Since Pexip Infinity is often deployed as the backbone for enterprise communications, compromising one node can lead to a cascading failure across the entire cluster if not contained immediately. This aligns with ATT&CK technique T1021.004, Remote Services: Distributed Components, where adversaries use internal APIs or services to move laterally through trusted relationships between systems within an organization's network perimeter.
Mitigation strategies must prioritize immediate patching of all affected nodes to version 38.2 or later, as well as versions 39.x and 40.x that have received the corresponding security update. In environments where patching is not immediately feasible, administrators should implement strict network segmentation between Pexip Infinity nodes using firewalls or virtual LANs to restrict inter-node API traffic only to necessary ports and protocols. Additionally, enforcing least-privilege principles for local user accounts on each node can reduce the attack surface by limiting the capabilities of any single compromised account. Regular auditing of internal API logs should also be conducted to detect anomalous cross-node requests that may indicate exploitation attempts in progress.