Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
n/a n/a — EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessi…
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H H N 9.1 .0039 32.2 —
AFFECTED
Product Versions Fixed
n/a n/a – —
TIMELINE
Jun 8 Reserved by mitre
Jul 13 EXPLOIT PUBLISHED — CVE-2026-51538. Public exploit reference added.
Jul 13 Published (CNA: mitre)
Description
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 8, 2026 | Reserved | Reserved by mitre |
| July 13, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-51538. Public exploit reference added. |
| July 13, 2026 | Published | Published (CNA: mitre) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| n/a | n/a | — | n/a | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-51538 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.