CVE-2026-50884: Incorrect access control in statping-ng v0

Synopsis

Incorrect access control in statping-ng v0.93.0 allows an authenticated attacker to escalate their privileges to Administrator level. The vulnerability is reachable over the network and requires only a low-privilege account to exploit, with no victim interaction needed. Successful exploitation gives the attacker full administrative access to sensitive components, enabling data disclosure, configuration tampering, and potential service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the statping-ng service over the network; there is no local-only restriction on the attack surface.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need administrator credentials to initiate the privilege escalation.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit the access control flaw directly without social engineering.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Attacker gains Administrator-level access to the statping-ng instance, reading all stored monitoring configuration, credentials, and status-page data.
• Attacker can modify or delete service monitors, status pages, and stored incident records.
• Attacker can access and exfiltrate any sensitive components exposed to the Administrator role, such as API keys or integration secrets.
• Attacker may disrupt monitoring availability by altering or removing service checks, masking real outages.