Overview

CVE-2026-103105 is a critical vulnerability in Pexip Infinity, a video conferencing and collaboration platform. The vulnerability is caused by improper access control on a product-internal API, which allows an attacker with local access to a node within the Pexip Infinity installation to execute arbitrary code as an unprivileged user on another node. This vulnerability has significant implications for organizations using affected versions of Pexip Infinity.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of CVE-2026-103105 is an improper access control vulnerability (CWE-863) in the Pexip Infinity product-internal API. This API does not properly restrict access, allowing an attacker with local access to a node within the Pexip Infinity installation to execute arbitrary code on another node.

Attack Surface & Vector

The attack surface for this vulnerability is the product-internal API of Pexip Infinity. An attacker needs to have local access to a node within the Pexip Infinity installation to exploit this vulnerability. The attack vector is adjacent network, as the attacker needs to be on the same network as the target node.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Pexip Infinity Node 1. Initial Position: An attacker gains local access to a node within a Pexip Infinity installation. 2. Triggering the Flaw: The attacker uses the product-internal API to send a crafted request to another node within the installation, exploiting the improper access control vulnerability. 3. What Breaks: The security boundary that restricts access to the product-internal API fails, allowing the attacker to execute arbitrary code on the target node. 4. Attacker's Prize: The attacker can now execute arbitrary code as an unprivileged user on another node within the Pexip Infinity installation, potentially leading to lateral movement, data exfiltration, or other malicious activities.

Real-World Impact

The impact of CVE-2026-103105 can be significant, as an attacker can use this vulnerability to gain unauthorized access to sensitive data or disrupt critical systems. If actively exploited, this vulnerability could lead to a range of malicious outcomes, including data theft, lateral movement, or ransomware deployment.

Detection & Defense

Immediate Mitigations

To address CVE-2026-103105, organizations should upgrade to a non-affected version of Pexip Infinity, such as version 38.2 or later. Additionally, organizations can implement network segmentation and access controls to limit the attack surface.

Detection Strategies

Defenders can detect exploitation attempts by monitoring network traffic and system logs for suspicious activity. Implementing a security information and event management (SIEM) system can help identify potential threats.

Long-Term Hardening

To prevent similar vulnerabilities in the future, organizations should implement a defense-in-depth strategy that includes:
  • Regularly updating and patching software
  • Implementing network segmentation and access controls
  • Monitoring network traffic and system logs
  • Conducting regular security audits and penetration testing

Key Takeaways

* CVE-2026-103105 is a high-severity vulnerability affecting Pexip Infinity versions before 38.2, 39.0, 39.1, and 40.0. * The vulnerability allows an attacker with local access to execute arbitrary code as an unprivileged user on another node within the Pexip Infinity installation. * Organizations should upgrade to a non-affected version of Pexip Infinity and implement network segmentation and access controls to limit the attack surface. * Defenders can detect exploitation attempts by monitoring network traffic and system logs.

Sources

* National Vulnerability Database (NVD) * Pexip Security Bulletins