Executive brief
A security vulnerability exists in Mysterium Node, a software used to run distributed VPN services. An unauthenticated attacker can remotely access a configuration interface and overwrite the node's settings. This allows an attacker to take full control of the node, potentially compromising user traffic, disrupting service, or using the node for unauthorized activities.
Technical details
An improper authorization vulnerability exists in the TequilAPI component of Mysterium Node. The '/tequilapi/config/user' endpoint was incorrectly included in a whitelist of unprotected routes, allowing it to bypass the reverse proxy's authentication requirements. A remote, unauthenticated attacker can send a crafted HTTP POST request to this endpoint to overwrite the node's configuration files. Successful exploitation results in full administrative control over the node. This issue was addressed in version 1.36.0 by removing the endpoint from the 'UnprotectedRoutes' list in the routing logic.
Affected products
- Mysterium Network Mysterium Node before v1.36.0
Timeline
- 2026-07-08: disclosed: CVE-2026-31309 published
- 2026-07-08: advisory
- 2023-11-14: patched: Version 1.36.0 released with fix
References
- https://github.com/mysteriumnetwork/node/
- https://github.com/mysteriumnetwork/node/blob/1.35.5/tequilapi/tequil/routes.go
- https://github.com/mysteriumnetwork/node/commit/83051199cd641dd4ed9057b958e5616df1309f19
- https://github.com/mysteriumnetwork/node/commit/bc099fcaff59fee9c8a8f8e07ffff5b3c5df2bb9
- https://github.com/mysteriumnetwork/node/releases/tag/1.35.5
- https://github.com/mysteriumnetwork/node/releases/tag/1.36.0
- https://github.com/sch8ill/CVE-2026-31309