Is CVE-2026-33552 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33552 being exploited in the wild.

How severe is CVE-2026-33552?

Informational severity, with a CVSS score of 0, published 27 May 2026.

Which products and versions are affected?

Northern.tech Mender Enterprise Server before 4.0.2, 4.1.0.

Is there a fix for CVE-2026-33552?

A patch was published on 2026-05-27: Fixed in Mender Server 4.1.1 and 4.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33552 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33552?

Check whether you run Northern.tech Mender Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33552: Northern.tech Mender Enterprise Server incorrect access control in Device Group RBAC

CVE-2026-33552 · Severity: info · CVSS 0 · Published 2026-05-27

Northern.tech Mender Enterprise Server, a platform used for managing and updating IoT device fleets, contained a flaw in its access control system. Under specific configurations where an administrator assigned different permission levels to different device groups, the system would incorrectly grant the higher 'Manage' permission to all groups. This could allow a user to modify or control devices they were only supposed to be able to view, increasing the potential impact if a low-privileged account is compromised.

Vendors: Northern.tech.

Quick answers

Is CVE-2026-33552 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33552 being exploited in the wild.
How severe is CVE-2026-33552?: Informational severity, with a CVSS score of 0, published 27 May 2026.
Which products and versions are affected?: Northern.tech Mender Enterprise Server before 4.0.2, 4.1.0.
Is there a fix for CVE-2026-33552?: A patch was published on 2026-05-27: Fixed in Mender Server 4.1.1 and 4.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33552 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33552?: Check whether you run Northern.tech Mender Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Role-Based Access Control (RBAC) system of Mender Enterprise Server allows for privilege escalation within device group management. When a user is assigned 'Read' access to one device group and 'Manage' access to another, the system fails to isolate these permissions, incorrectly granting 'Manage' access across both groups. This flaw is rooted in the logic used to combine multiple RBAC policies. An attacker with an existing low-privileged account could exploit this to perform unauthorized management actions on restricted device groups. The issue is fixed in versions 4.0.2 and 4.1.1; it does not affect the Open Source (Community) edition as RBAC is an Enterprise-only feature.

Affected products

Northern.tech Mender Enterprise Server before 4.0.2, 4.1.0

Timeline

2026-05-27: disclosed: Vulnerability disclosed via Northern.tech blog and CVE published.
2026-05-27: patched: Fixed in Mender Server 4.1.1 and 4.0.2.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.