CVE-2024-41260

State: Published
Severity: 7.5 High
Published: Aug 1, 2024
Updated: Dec 15, 2025
Reserved: Jul 18, 2024

Description

A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636
https://github.com/netbirdio/netbird/pull/2569
https://github.com/github/advisory-database/pull/5714

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.