SoftIron — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by SoftIron (softiron). https://vulnogram.org/seaview/icons/softiron.png SoftIron — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT CVE-2026-1842 · 6.2 MEDIUM — HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access https://vulnogram.org/CVE-2026-1842 https://vulnogram.org/CVE-2026-1842 HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly long… Medium Fri, 20 Feb 2026 16:23:16 GMT CVE-2025-10650 · 1.8 LOW — Improper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative Users https://vulnogram.org/CVE-2025-10650 https://vulnogram.org/CVE-2025-10650 SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal deve… Low Thu, 18 Sep 2025 19:11:51 GMT CVE-2024-13058 · 4.8 MEDIUM — Authenticated, non-admin users can create storage pools via the sifi API https://vulnogram.org/CVE-2024-13058 https://vulnogram.org/CVE-2024-13058 An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron… Medium Mon, 30 Dec 2024 22:08:31 GMT CVE-2023-45085 · 3.2 LOW — When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT" https://vulnogram.org/CVE-2023-45085 https://vulnogram.org/CVE-2023-45085 An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which… Low Tue, 05 Dec 2023 16:15:45 GMT CVE-2023-45084 · 7 HIGH — Media caddy removal and reinsertion without reboot may cause data loss https://vulnogram.org/CVE-2023-45084 https://vulnogram.org/CVE-2023-45084 An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impact… High Tue, 05 Dec 2023 16:15:31 GMT CVE-2023-45083 · 4.2 MEDIUM — HyperCloud: "admin" and "serveradmin" users can be deleted https://vulnogram.org/CVE-2023-45083 https://vulnogram.org/CVE-2023-45083 An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, whic… Medium Tue, 05 Dec 2023 16:15:07 GMT