CVE-2026-43510 in manage.get.gov
Summary
by MITRE • 05/07/2026
manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domains not already in another organization. Fixed in 1.176.0 on or around 2026-04-30.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/25/2026
The manage.get.gov platform represents a critical infrastructure component serving as the .gov top-level domain registrar managed by the Cybersecurity and Infrastructure Security Agency. This system facilitates domain management operations for federal agencies and government organizations, making it a prime target for adversaries seeking to compromise government digital assets. The platform's functionality enables organization administrators to delegate domain management privileges to users across different organizational boundaries, creating a complex access control environment that requires robust security measures.
This vulnerability existed within the domain assignment and privilege delegation mechanisms of the manage.get.gov system. The flaw allowed administrators to assign domain manager privileges for domains that were not already associated with another organization, potentially enabling unauthorized privilege escalation or cross-organizational access. The technical nature of the vulnerability likely stemmed from insufficient validation of domain ownership relationships and organizational boundaries during the privilege assignment process, creating a pathway for malicious actors to gain unauthorized administrative access to government domains. Such a vulnerability would fall under CWE-284 Access Control Issues, specifically addressing improper access control mechanisms in privilege assignment systems.
The operational impact of this vulnerability was significant for federal agencies and government organizations relying on the .gov domain infrastructure. An attacker exploiting this flaw could potentially gain administrative control over government domains without proper authorization, leading to potential data breaches, service disruption, or malicious domain manipulation. The vulnerability created a potential attack surface that could be leveraged for advanced persistent threats or supply chain attacks against government digital infrastructure. From an adversary perspective, this represents a technique categorized under ATT&CK T1078 Valid Accounts, where attackers might use compromised or improperly assigned privileges to maintain access to government systems. The risk extended beyond immediate domain compromise to potential credential theft and lateral movement within government networks.
The vulnerability was addressed through a software update released in version 1.176.0, with the fix deployed around April 30, 2026. This update implemented enhanced validation mechanisms for domain assignment processes, ensuring proper organizational boundary enforcement and preventing unauthorized privilege delegation across organizational contexts. The fix likely incorporated additional checks to verify domain ownership relationships and implemented stricter access control policies for cross-organizational privilege assignment. Organizations should have monitored for this update and applied it promptly to maintain the security posture of their government domain management infrastructure. The resolution demonstrates the importance of continuous security monitoring and timely patch management for critical infrastructure components, particularly those managing government domain resources that form the foundation of federal digital services and cybersecurity operations.