What’s Vulnerable › Vulnerabilities

CVE-2026-33906: Ella Core has Privilege Escalation via Database Restore by NetworkManager role

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-27 · updated 2026-10-26
• Weakness: CWE-269

Description

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup and restore permission. The restore endpoint accepted any valid SQLite file without verifying its contents. A NetworkManager could replace the production database with a tampered copy to escalate to Admin, gaining access to user management, audit logs, debug endpoints, and operator identity configuration that the role was explicitly denied. In version 1.7.0, backup and restore permissions have been removed from the NetworkManager role.

Affected products

• ellanetworks core: before 1.7.0 — fixed in 1.7.0

How to fix

Upgrade to a fixed version: ellanetworks core 1.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/ellanetworks/core/commit/1e4768288a6519fcb63ec83f851584ecebb8a972
• https://github.com/ellanetworks/core/releases/tag/v1.7.0
• https://github.com/ellanetworks/core/security/advisories/GHSA-87j9-m7x6-hvw2

Get alerted when CVE-2026-33906 or the next vulnerability affects your stack