CVE-2026-90441
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
- Published Sep 30, 2026
- CVSS 7.1 high
- 0.2% chance of exploitation in the next 30 days (EPSS)