J
member badge
Johannes Rudolph
  • Issue:
    Insufficient Session Expiration (CWE-613) in meshStack
  • Criticality:
    Medium (CVSS 3.1 base score 4.2)
  • Affected meshStacks:
    All meshStack versions before v2026.46.0
  • Impact:
    An insufficient session expiration vulnerability in meshStack allowed specific holders of credentials to continue using them beyond the scope where a user would expect them to be revoked by meshStack. The vulnerability was limited to holders of such credentials, isolated to your meshStack instance and provided only the access these credentials had before. As meshStack stores secrets and credentials in encrypted or hashed form, no plaintext secrets or credentials could be exposed.
  • Recommended Action:
    Upgrade meshStack to v2026.46.0 at the next maintenance window. meshStack SaaS customers do not have to take action, as we will upgrade your meshStack automatically at the next maintenance window.
In line with our coordinated disclosure policy, we will not provide further technical details until this patch has been applied to all meshStack instances. We will then add them to this advisory.
Additional Details
We found the issue during the investigation of a support case and have no indication that the vulnerability was exploited.