Critical CVE-2026-85181 Vulnerability: CAT Session Cookie Integrity Check Flaw
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- cve-2026-85181 (maven)
- Affected versions
- >= 3.1.0, <= 3.1.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability, CVE-2026-85181, affecting CAT. This flaw allows potential forging of session cookies, enabling unauthorized admin access.
What happened
CVE-2026-85181 is a critical vulnerability that has been identified in CAT, specifically in its session cookie integrity check mechanism. The issue arises from the use of Java String.hashCode as the sole integrity check for session cookies, without server-side keying. This design flaw allows attackers to potentially forge valid checksums offline. Furthermore, attackers can manipulate the x-forwarded-for header to bypass IP binding validation, thereby creating admin sessions with full configuration access. The affected version range is from 3.1.0 to 3.1.0, as reported by osv.
This vulnerability is currently under investigation and has not been reported as exploited in the wild. However, given its critical nature and the potential for severe impact, it is imperative for organizations using CAT to assess their exposure and take appropriate action.
What to do about it
- Investigate the use of CAT in your environment to determine if you are affected by CVE-2026-85181.
- Consider implementing alternative integrity check mechanisms for session cookies to mitigate the risk of cookie forgery.
- Review and strengthen your IP binding validation processes to prevent unauthorized admin session creation.
- Monitor the primary sources for updates on this vulnerability, as no official fix has been published yet.
How 0Day would have caught this
cve-2026-85181 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using CAT version 3.1.0, you are potentially affected by CVE-2026-85181.
What should I do right now?
Immediately investigate your use of CAT and consider alternative integrity check mechanisms for session cookies.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.
How severe is this vulnerability?
This vulnerability is classified as critical with a CVSS score of 9.8.