Skip to content
Fencer Vulns
medium 4.2

CVE-2026-5107 json

FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control

published 2026-03-30 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-17060

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Patch / fix

  • frr Debian 12 8.4.4-1.1~deb12u2
  • frr Debian 13 10.3-3+deb13u1
  • frr Debian 14 10.6.0-2

debian advisories DEBIAN-CVE-2026-5107

  • frr Ubuntu 22.04 LTS 8.1-1ubuntu1.15
  • frr Ubuntu 24.04 LTS 8.4.4-1.1ubuntu6.6
  • frr Ubuntu 25.10 10.4.1-3ubuntu1.2
  • frr Ubuntu Pro 20.04 LTS 7.2.1-1ubuntu0.2+esm4

ubuntu advisories UBUNTU-CVE-2026-5107

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • frr SLE Module for Server Applications 15 SP7 10.2.6-150700.3.10.1
  • frr SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 8.5.7-150500.4.43.1
  • frr SLES for SAP applications 16.0, SLES 16.0 10.2.6-160000.1.1
  • frr SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 8.5.7-8.16.1

suse advisories SUSE-SU-2026:2457-1SUSE-SU-2026:2455-1SUSE-SU-2026:2454-1SUSE-SU-2026:22026-1

  • frr openSUSE Tumbleweed 10.5.1-3.1

opensuse advisories openSUSE-SU-2026:10606-1

  • frr Azure Linux 3.0 10.5.0-2

azure linux advisories AZL-81087

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5107 updated cvss 4.2

FRRouting FRR: frr: FRRouting FRR: Improper access controls in EVPN Type-2 Route Handler

  • Red Hat Enterprise Linux 8 frr, frr-contrib, frr-selinux Red Hat Enterprise Linux 9 frr, frr10, frr-selinux, frr10-selinux Red Hat Enterprise Linux 10 frr
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CNA 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
CNA 3.0 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
CNA 2.0 3.6 AV:N/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CNA 2.0 3.6 AV:N/AC:H/Au:S/C:N/I:P/A:P

Affected products

  • FRRouting FRR

Classification

Weakness
  • CWE-284 Improper Access Control
  • CWE-266 Incorrect Privilege Assignment

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.