Loading vulnerability…
Cross-tenant node description disclosure in APITable
APITable through version 1.14.0-beta contains an authorization bypass in its node-description retrieval endpoint. An authenticated user can supply a user-controlled node identifier to retrieve descriptions without space membership or node permission checks. This exposes datasheet, folder, and form descriptions belonging to other tenants. Attribution to CVE-2026-111344 is uncertain because the identifier is also associated with a distinct NetScaler Endpoint Analysis memory-overflow vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Authenticated users can read descriptions of datasheets, folders, and forms outside their authorized spaces, breaching tenant isolation and potentially exposing sensitive descriptive information. Access to underlying datasheet records, modification capabilities, and code execution are not established.
If you can’t patch tonight, do this now.
No CVE-specific interim workaround is explicitly documented. Review VPN and AAA virtual-server configurations to identify deployments using Endpoint Analysis, and prioritize those appliances for patching. Configuration assessment does not replace installation of the applicable security update.
Patch, then assume compromise.
Upgrade to the applicable fixed release: NetScaler ADC and Gateway 14.1-73.57 or later; 13.1-64.39 or later within the 13.1 branch; NetScaler ADC 14.1-FIPS 14.1-73.58 or later; or NetScaler ADC 13.1-FIPS/NDcPP 13.1-37.293 or later within the respective branch. Upgrade both nodes of high-availability pairs and affected customer-managed NetScaler instances supporting Secure Private Access Hybrid deployments. Migrate unsupported 12.1 and 13.0 installations to a supported, fixed release. Plan for appliance upgrades to terminate existing ICA sessions.
No public exploits tracked yet. Mallory keeps watching.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.