CVE-2026-71879: Authentication bypass in Integrated Publishing Toolkit

Severity: critical (CVSS 9.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-288

Description

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Affected products

GBIF Integrated Publishing Toolkit: before 3.3.4 — fixed in 3.3.4

How to fix

Upgrade to a fixed version: GBIF Integrated Publishing Toolkit 3.3.4. Check the vendor advisory for mitigations.

References

https://github.com/gbif/ipt/issues/3115
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0015.md
https://www.gbif.org/ipt

Get alerted when CVE-2026-71879 or the next vulnerability affects your stack