Executive brief
MikroTik RouterOS, the operating system used in MikroTik routers and wireless systems, contains a flaw in how it manages API sessions. When an administrator reduces a user's permissions or when a session should time out due to inactivity, the system may fail to properly expire the old session, allowing the user to maintain their previous higher level of access. This could allow a user with downgraded permissions to continue accessing sensitive information, including private VPN keys, potentially leading to unauthorized network access and data decryption.
Technical details
A vulnerability classified as Insufficient Session Expiration (CWE-613) exists in the MikroTik RouterOS API. The root cause is a failure in the session management logic to re-validate or terminate active API sessions when user permissions are modified or inactivity thresholds are met. An authenticated attacker with high-level privileges that have been subsequently revoked or downgraded can maintain their original access level. Exploitation can lead to the extraction of WireGuard private keys in plaintext, enabling VPN impersonation. As of the advisory date, MikroTik recommends manually logging out affected users after permission changes as a mitigation, as all versions are currently listed as affected.
Affected products
- MikroTik RouterOS All versions
Timeline
- 2026-07-30: disclosed: Initial publication of ICSA-26-211-01
- 2026-07-30: advisory: NVD published CVE-2026-14227