CVE-2026-43510: CISA manage.get.gov insecure portfolio administrative privileges

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-07 · updated 2026-10-26
Weakness: CWE-266

Description

manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domains not already in another organization. Fixed in 1.176.0 on or around 2026-04-30.

Affected products

CISA manage.get.gov: from 1.92.0 before 1.176.0 — fixed in 1.176.0

How to fix

Upgrade to a fixed version: CISA manage.get.gov 1.176.0. Check the vendor advisory for mitigations.

References

https://github.com/cisagov/manage.get.gov/issues/4858
https://github.com/cisagov/manage.get.gov/pull/4900
https://github.com/cisagov/manage.get.gov/releases/tag/v1.176.0
https://github.com/cisagov/manage.get.gov/security/advisories/GHSA-6wrg-x3j6-x464
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-121-01.json
https://www.cve.org/CVERecord?id=CVE-2026-43510
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H

Get alerted when CVE-2026-43510 or the next vulnerability affects your stack