CVE-2026-26422
8.4 HIGHclash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation
Published: 2026-06-06 · Last updated: 2026-06-08
Severity and scoring
- CVSS
- 8.4 HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-732
Description
clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-26422
- [Other]https://github.com/clash-verge-rev/clash-verge-rev/commit/3bbcdbe5caacc2ffb713af69f2c93e202573f918
- [Other]https://github.com/clash-verge-rev/clash-verge-service-ipc/releases/tag/v2.3.0
- [Other]https://kaguranaku.me/posts/CVE-2026-26422/
- [Other]https://kaguranaku.me/posts/CVE-2026-26422/
Related CVEs
Same CWE
- CVE-2026-0271 — A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to exec...
- CVE-2026-50570 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (8.5 HIGH)
- CVE-2026-50590 — In Mimecast Incydr before 2.6.0, arbitrary file access can occur (4.5 MEDIUM)
- CVE-2026-10997 — Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install... (6.5 MEDIUM)
- CVE-2026-10840 — A flaw was found in the OpenShift Pipelines operator (7.1 HIGH)