Authentication bypass in Cisco Secure Workload internal REST APIs
CVE-2026-20223 is a critical authentication and access-validation flaw in the internal REST API endpoints of Cisco Secure Workload Cluster Software. The issue is caused by insufficient validation and authentication when processing requests to affected internal API endpoints. A remote attacker can send a crafted API request to a vulnerable endpoint without prior authentication and gain access to site resources with the privileges of the Site Admin role. Cisco states the flaw affects both SaaS and on-premises Secure Workload deployments, although the web-based management interface is not affected. Successful exploitation can cross tenant boundaries, allowing unauthorized access to sensitive information and administrative configuration functions.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone PoC repository for CVE-2026-20223 targeting Cisco Secure Workload. It contains 5 files total: a README and license, plus two executable PoC implementations—one in Python and one in Bash. The Python script defines a CiscoSecureWorkloadPoC class, sets up a requests session with TLS verification disabled, enumerates a list of privileged REST API endpoints, performs unauthenticated GET requests to identify exposed resources, and then attempts POST requests with JSON user-creation data when an endpoint appears accessible. It also includes a dedicated create_admin_user() routine that posts directly to /api/v1/users to create a Site Admin account. The Bash script mirrors the same logic using curl, logs results, stores temporary responses under /tmp, and tests one extra endpoint (/api/v1/config). Overall, the exploit capability is unauthorized access to privileged web API endpoints and potential unauthenticated creation of a high-privilege administrative user. This is not merely a detector: it includes active exploitation behavior via POST requests and hardcoded account-creation payloads, making it an operational PoC rather than a passive scanner.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
63 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical CVSS 10.0 authentication-related vulnerability in the internal APIs of Cisco Secure Workload that could expose a highly privileged zero-trust segmentation platform.
A critical authentication/authorization flaw in Cisco Secure Workload internal REST API endpoints that could allow an unauthenticated remote attacker to read sensitive information and make configuration changes across tenant boundaries with Site Admin-level privileges.
A maximum-severity authentication and validation flaw in Cisco Secure Workload REST API endpoints that could allow an unauthenticated remote attacker to read sensitive information and make configuration changes across tenant boundaries with Site Admin privileges.
A critical improper authentication/access control vulnerability in Cisco Secure Workload internal REST API endpoints that allows unauthenticated remote attackers to send crafted API requests, gain Site Admin privileges, and access or modify resources across tenant boundaries.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.