External risk intelligence

CDP Coordinator Service Authorization Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-108142

The vulnerability affects the CDP Coordinator Service, a component typically found in backup and disaster recovery solutions. Such services are often deployed in network-accessible roles to coordinate data movement across infrastructure, making them plausibly exposed to network-based attackers in standard enterprise deployment architectures.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the CDP Coordinator Service, which could allow an unauthenticated attacker to bypass authorization controls. This is a concern due to the potential for unauthorized access and manipulation of data coordination services. The primary focus is to confirm if our environment utilizes this specific service and is therefore potentially exposed.

Unauthenticated attackers can bypass authorization.
Confirms relevance to our systems.
Prioritize assessing exposure and impact.

Attack Path

How an attacker could exploit the issue

An attacker could target the CDP Coordinator Service to bypass authorization controls, potentially leading to unauthorized access and modification of data. This could allow an unauthenticated attacker to reach and trigger the vulnerability from the network.

Unauthenticated network access required.
Authorization bypass on CDP Coordinator Service.
Unauthorized access and data modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authorization controls within the CDP Coordinator Service, potentially leading to unauthorized actions or access when the service is exposed to the network.

CDP Coordinator Service is at risk.
Bypass authorization when network-exposed.
Unauthorized actions may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the CDP Coordinator Service may require action from infrastructure, platform, or security teams, depending on how the service is deployed and managed. The first practical step is to identify all instances of the CDP Coordinator Service within your environment, determine their network exposure and business criticality, and confirm the accountable owner for each instance to plan a risk-based remediation strategy.

Own by Infrastructure or Platform teams.
Verify network reachability and business impact.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the CDP Coordinator Service?

The CDP Coordinator Service is a specialized component used within data protection and disaster recovery software. It manages the orchestration and movement of data, ensuring that continuous data protection tasks are executed across an organization's infrastructure. It acts as a central hub for coordinating backup operations and maintaining system integrity.

What does an authorization bypass mean in CVE-2026-108142?

This vulnerability, classified as CWE-636, refers to a failure to maintain expected security boundaries. It means the service does not correctly verify the identity or permissions of a requestor. Consequently, an attacker can perform actions that should be restricted, allowing them to interact with or manipulate the service as if they were a trusted or authenticated user.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specific network requests to the CDP Coordinator Service without needing any prior credentials. It is important to note that the vulnerability is specifically tied to the service's authorization logic; requests that are already properly authenticated are not the primary target, though the flaw fundamentally undermines the security of any connection to this service.

Is my environment at risk from this vulnerability?

Halo Surface Signal indicates that because the CDP Coordinator Service often requires network connectivity to function, it is frequently deployed in roles where it can be reached over the network. If your instance of this service is accessible to external network traffic, it is considered more likely to be reachable by an unauthorized actor attempting to exploit this bypass.

What steps should I take if I use this software?

Start by locating all instances of the CDP Coordinator Service within your infrastructure to build an accurate inventory. Once identified, evaluate the network accessibility of each instance and determine its business criticality. Work with your infrastructure or platform teams to establish ownership and prepare to apply updates or security controls according to your organization's risk management policy.

References

www.veeam.com/kb4948

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.