CVE-2026-23811
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Mar 4, 2026
CISA due date
—
The record
A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-84197 In Eclipse Ditto's Node.js JavaScript client, all released versions of… CWE-300
- CVE-2025-29419 CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack. CWE-300
- CVE-2026-23810 A vulnerability in the packet processing logic may allow an authenticated attacker to… CWE-300
- CVE-2026-23812 A vulnerability has been identified where an attacker connecting to an access point as a… CWE-300
- GHSA-pc5p-h8pf-mvwp Machine-In-The-Middle in https-proxy-agent CWE-300