Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-9831

ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ExtremeNetworks

Description

A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Extreme Networks Extreme Platform ONE

Default version status: unaffected

  • 0 to < 25.10.0-104affected
  • 25.10.0-104unaffected

References