CVE-2026-6209: Improper Access Control in in HAVELSAN's Geographic Tracking System

Synopsis

An improper access control vulnerability in HAVELSAN Inc.'s Geographic Tracking System allows unauthenticated remote attackers to access functionality that should be restricted by access control lists (ACLs). The service is reachable over the network and requires no authentication, credentials, or victim interaction to exploit. Successful exploitation gives an attacker full read and write access to the system's data, enabling both disclosure of tracked geographic information and tampering with records. A patched-image rebuild at v0.0.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network, meaning an attacker must be able to reach it via standard network connectivity to exploit this vulnerability.

• AuthenticationNot required

  No credentials or account of any privilege level are needed; the missing authorization check is reachable by any unauthenticated request.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental factors to succeed.

Blast Radius

• Reads geographic tracking records and any associated location or entity data stored in the system.
• Modifies or overwrites tracking records, allowing an attacker to corrupt location history or inject false tracking data.
• Accesses functionality gated behind ACLs, potentially including administrative or operational controls within the tracking system.
• No availability impact is indicated by the CVSS vector; the service itself remains running but its data integrity and confidentiality are fully compromised.