# CVE-2026-54106: GAO and CBCA Docketing Systems network access control bypass

Source: https://junglewise.ai/threats/cve-2026-54106-gao-and-cbca-docketing-systems-network-access-control-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-54106 · Severity: medium · CVSS 4.7 · Published 2026-06-18

The U.S. Government Accountability Office (GAO) and the Civilian Board of Contract Appeals (CBCA) use specialized docketing systems to manage legal protests and contract appeals. A security flaw in these systems allows an attacker who has already stolen administrator credentials to bypass network-based security restrictions by spoofing their location. This could allow unauthorized access to sensitive legal filings and administrative controls from restricted or untrusted networks.

## Quick answers

**Is CVE-2026-54106 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54106 being exploited in the wild.

**How severe is CVE-2026-54106?** Medium severity, with a CVSS score of 4.7, published 18 June 2026.

**Which products and versions are affected?** Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions before 2026-02-22; Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions before 2026-03-19.

**Is there a fix for CVE-2026-54106?** A patch was published on 2026-02-22: GAO EPDS patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54106 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-54106?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as an improper verification of source (CWE-940) within the GAO EPDS and CBCA EDS platforms. The systems do not properly validate the 'X-Forwarded-For' HTTP header, which is commonly used to identify the originating IP address of a client connecting through a proxy. A remote attacker who has obtained valid administrator credentials can manipulate this header to spoof a trusted IP address, thereby bypassing network access control lists (ACLs) or IP-based authentication restrictions. This allows the attacker to log in from unauthorized network locations. Patches were released for EPDS on 2026-02-22 and for EDS on 2026-03-19.

## Affected products

- Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions before 2026-02-22
- Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions before 2026-03-19

## Timeline

- 2026-02-22: patched: GAO EPDS patch released
- 2026-03-19: patched: CBCA EDS patch released
- 2026-06-18: disclosed: NVD publication date

## References

- [https://epds.gao.gov/](https://epds.gao.gov/)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json)
- [https://www.cve.org/CVERecord?id=CVE-2026-54106](https://www.cve.org/CVERecord?id=CVE-2026-54106)
- [https://www.eds.cbca.gov/login](https://www.eds.cbca.gov/login)