Is CVE-2026-42543 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42543 being exploited in the wild.

How severe is CVE-2026-42543?

Medium severity, with a CVSS score of 4.3, published 4 June 2026.

Is there a fix for CVE-2026-42543?

A patch was published on 2026-04-27: Version 2.4.28 tagged with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42543 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42543?

Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42543: DFIR-IRIS IRIS CSRF via HTTP GET in state-changing endpoints

CVE-2026-42543 · Severity: medium · CVSS 4.3 · Published 2026-06-04

IRIS is a collaborative web platform used by incident responders to manage and share technical details during security investigations. A vulnerability in the platform allows attackers to trick logged-in users into performing unintended actions, such as rotating their API security tokens or being forcibly logged out. This could disrupt ongoing investigations or break automated integrations that rely on the affected API tokens.

Technologies: DFIR-IRIS Iris. Vendors: DFIR-IRIS.

Quick answers

Is CVE-2026-42543 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42543 being exploited in the wild.
How severe is CVE-2026-42543?: Medium severity, with a CVSS score of 4.3, published 4 June 2026.
Which products and versions are affected?: DFIR-IRIS Iris <= 2.4.27.
Is there a fix for CVE-2026-42543?: A patch was published on 2026-04-27: Version 2.4.28 tagged with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42543 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42543?: Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The IRIS web application is vulnerable to Cross-Site Request Forgery (CSRF) because it incorrectly trusts HTTP GET methods for state-changing operations, such as API token renewal and user logout. While the application implements CSRF tokens for POST requests, these protections are bypassed when the server accepts parameters via GET. An unauthenticated remote attacker can exploit this by luring an authenticated user to a malicious website or by embedding malicious tags (e.g., <img> tags) within the IRIS application itself. Successful exploitation can lead to unauthorized API key rotation, which invalidates existing tokens and disrupts integrated services, or forced session termination. The issue is addressed in version 2.4.28 by ensuring state changes require POST requests and enforcing proper method validation.

Affected products

DFIR-IRIS IRIS <= 2.4.27

Timeline

2026-01-28: other: Vulnerability identified in version 2.4.26
2026-01-30: other: Initial vendor contact
2026-04-27: patched: Version 2.4.28 tagged with fix
2026-05-19: disclosed: Public disclosure via oss-security and SBA Research
2026-06-04: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.