CVE-2026-18972
Critical · CVSS 9.6- CVSS
- 9.6
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-290
Description
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.
References
Status: profiled · ingested 2026-08-29T00:00:49.000Z