Is CVE-2026-54106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54106 being exploited in the wild.

How severe is CVE-2026-54106?

Medium severity, with a CVSS score of 4.7, published 18 June 2026.

Which products and versions are affected?

Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions before 2026-02-22; Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions before 2026-03-19.

Is there a fix for CVE-2026-54106?

A patch was published on 2026-02-22: GAO EPDS patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54106 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-54106?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54106: GAO and CBCA Docketing Systems network access control bypass

CVE-2026-54106 · Severity: medium · CVSS 4.7 · Published 2026-06-18

The U.S. Government Accountability Office (GAO) and the Civilian Board of Contract Appeals (CBCA) use specialized docketing systems to manage legal protests and contract appeals. A security flaw in these systems allows an attacker who has already stolen administrator credentials to bypass network-based security restrictions by spoofing their location. This could allow unauthorized access to sensitive legal filings and administrative controls from restricted or untrusted networks.

Quick answers

Is CVE-2026-54106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54106 being exploited in the wild.
How severe is CVE-2026-54106?: Medium severity, with a CVSS score of 4.7, published 18 June 2026.
Which products and versions are affected?: Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions before 2026-02-22; Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions before 2026-03-19.
Is there a fix for CVE-2026-54106?: A patch was published on 2026-02-22: GAO EPDS patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54106 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54106?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an improper verification of source (CWE-940) within the GAO EPDS and CBCA EDS platforms. The systems do not properly validate the 'X-Forwarded-For' HTTP header, which is commonly used to identify the originating IP address of a client connecting through a proxy. A remote attacker who has obtained valid administrator credentials can manipulate this header to spoof a trusted IP address, thereby bypassing network access control lists (ACLs) or IP-based authentication restrictions. This allows the attacker to log in from unauthorized network locations. Patches were released for EPDS on 2026-02-22 and for EDS on 2026-03-19.

Affected products

Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions before 2026-02-22
Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions before 2026-03-19

Timeline

2026-02-22: patched: GAO EPDS patch released
2026-03-19: patched: CBCA EDS patch released
2026-06-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.