Is CVE-2026-103053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103053 being exploited in the wild.

How severe is CVE-2026-103053?

Medium severity, with a CVSS score of 5.4, published 30 September 2026.

Is there a fix for CVE-2026-103053?

A patch was published on 2026-09-27: Fix committed before NVD publication Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103053 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-103053?

Check whether you run Beenuar AiSOC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103053: AiSOC authentication bypass in response-action API endpoints

CVE-2026-103053 · Severity: medium · CVSS 5.4 · Published 2026-09-30

AiSOC is a security operations platform that responds to detected threats by executing containment actions on protected endpoints. Versions 9.0.0 through 11.x fail to enforce authentication on APIs that approve and execute these actions when run in the default Docker Compose configuration. Unauthenticated attackers can submit and execute containment actions such as isolating hosts, disabling user accounts, or blocking IP addresses, using the platform's own vendor credentials.

Technologies: Beenuar AiSOC. Vendors: Beenuar.

Quick answers

Is CVE-2026-103053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103053 being exploited in the wild.
How severe is CVE-2026-103053?: Medium severity, with a CVSS score of 5.4, published 30 September 2026.
Which products and versions are affected?: Beenuar AiSOC 9.0.0 to 11.2.0.
Is there a fix for CVE-2026-103053?: A patch was published on 2026-09-27: Fix committed before NVD publication Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103053 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-103053?: Check whether you run Beenuar AiSOC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication guard in the actions service fails closed when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty, a state that occurs in default Docker Compose deployments where dev mode is enabled by default and the token is never generated. This allows unauthenticated requests to the response-action API endpoints (dispatch endpoints for isolate_host, disable_user, block_ip, run_script) that should require a service bearer token. Attackers need only network access to the Docker Compose network.

Affected products

beenuar AiSOC 9.0.0 to 11.2.0

Timeline

2026-09-30: disclosed
2026-09-27: patched: Fix committed before NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.