CVE-2026-54106
published 2026-06-18CVE-2026-54106: The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing…
PriorityP429medium4.7CVSS 3.1
AVNACLPRHUINSUCLILAL
EPSS
0.29%
20.5th percentile
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| civilian_board_of_contract_appeals | electronic_docketing_system | < 2026-03-19 | 2026-03-19 |
| government_accountability_office | electronic_protest_docketing_system | < 2026-02-22 | 2026-02-22 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-96f7-vmp7-7rvh: The U
ghsa_unreviewed·2026-06-18
CVE-2026-54106 [MEDIUM] CWE-940 GHSA-96f7-vmp7-7rvh: The U
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
VulDB
Government Accountability Office Electronic Protest Docketing System prior 2026-02-22 Header X-Forwarded-For verification of source (EUVD-2026-37913)
vuldb·2026-06-18
CVE-2026-54106 [LOW] Government Accountability Office Electronic Protest Docketing System prior 2026-02-22 Header X-Forwarded-For verification of source (EUVD-2026-37913)
A vulnerability labeled as problematic has been found in Government Accountability Office Electronic Protest Docketing System and Electronic Docketing System. This affects an unknown part of the component Header Handler. Such manipulation of the argument X-Forwarded-For leads to improper verification of source of a communication channel.
This vulnerability is uniquely identified as CVE-2026-54106. The attack can be launched remotely. No exploit exists.
This product is provided as a managed service, meaning users do not have the ability to maintain vulnerability countermeasures themselves. The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-18
Published