Database API Vulnerability in Zenitel Connect Firmware

CVE-2026-95613

What is CVE-2026-95613?

The pREST database REST API within Zenitel Connect firmware prior to version 1.11.0 employs inadequate security measures by signing and verifying JSON Web Tokens (JWTs) with the platform's Certificate Authority (CA) private key. This key is incorrectly stored in a shared data volume between containers, exposing it to local attackers. Additionally, the API sets the PostgreSQL session role using the unvalidated 'sub' claim from requests while connected as the 'postgres' superuser. Consequently, any attacker with access to the CA private key can execute extensive database operations — including reading sensitive information like the master encryption key and password hashes — by issuing a forged JWT with 'sub=postgres' to the pREST API.

References