# CVE-2026-49009: Northern.tech Mender Server directory traversal in artifact creation endpoint

Source: https://junglewise.ai/threats/cve-2026-49009-northern-tech-mender-server-directory-traversal-in-artifact  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-49009 · Severity: info · CVSS 8.8 · Published 2026-05-27

Northern.tech Mender Server, a platform used for managing over-the-air (OTA) software updates for IoT devices, contains a security flaw in its artifact creation process. An attacker with a valid user account could exploit this to access restricted files on the server and inject malicious code into software updates. If successful, this could lead to the distribution of compromised software to connected devices, though devices using cryptographic signature verification are protected from installing these malicious updates.

Vendors: [Northern.tech](https://junglewise.ai/threats/vendors/northern-tech).

## Quick answers

**Is CVE-2026-49009 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49009 being exploited in the wild.

**How severe is CVE-2026-49009?** Informational severity, with a CVSS score of 8.8, published 27 May 2026.

**Which products and versions are affected?** Northern.tech Mender Server 4.1.0, 4.0.1 and below.

**Is there a fix for CVE-2026-49009?** A patch was published on 2026-05-27: Fixed in versions 4.1.1 and 4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49009 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49009?** Check whether you run Northern.tech Mender Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists in the Mender Server API and UI endpoint used for creating artifacts. Due to improper input sanitization of request parameters, an authenticated attacker can use path traversal sequences (e.g., '../') to access and modify files outside of the intended directory within the server container. This allows an attacker to inject arbitrary malicious code into artifacts during the creation process. The impact is particularly high in multi-tenant environments where an attacker can easily obtain low-privileged credentials. The vulnerability is mitigated if the Mender Client is configured to verify cryptographically signed artifacts. Fixed versions include 4.1.1 and 4.0.2.

## Affected products

- Northern.tech Mender Server 4.1.0, 4.0.1 and below

## Timeline

- 2026-05-27: disclosed: Disclosed via Northern.tech blog and HackerOne program
- 2026-05-27: patched: Fixed in versions 4.1.1 and 4.0.2
- 2026-05-27: advisory

## References

- [https://mender.io/blog/cve-2026-49009-cve-2026-33552-input-sanitization-and-access-control-issues-in-mender-server](https://mender.io/blog/cve-2026-49009-cve-2026-33552-input-sanitization-and-access-control-issues-in-mender-server)
- [https://northern.tech/](https://northern.tech/)