What’s Vulnerable › Vulnerabilities

CVE-2026-26422

• Severity: high (CVSS 8.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-06 · updated 2026-07-23
• Weakness: CWE-732

Description

clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.

Affected products

• Clash Verge Rev clash-verge-service-ipc: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: Clash Verge Rev clash-verge-service-ipc 2.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/clash-verge-rev/clash-verge-rev/commit/3bbcdbe5caacc2ffb713af69f2c93e202573f918
• https://github.com/clash-verge-rev/clash-verge-service-ipc/releases/tag/v2.3.0
• https://kaguranaku.me/posts/CVE-2026-26422/
• https://kaguranaku.me/posts/CVE-2026-26422/

Get alerted when CVE-2026-26422 or the next vulnerability affects your stack