CVE-2026-31309

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.

Published 2026-07-08. Last modified 2026-07-16.