CVE-2026-19441

CVE-2026-19441 is a Missing Authentication for Critical Function (CWE-306) in IKAS Rush, affecting versions through the '21082026' build string. The vulnerable function allows an unauthenticated user to 'fake the source of data' — an explicit capability that fabricates data provenance metadata without any credentials. The '21082026' date string is notable. This appears to be a development build that shipped, likely representing an orphaned or abandoned branch where development stopped but binaries continued distributing. If the version counter stopped updating because the project moved elsewhere or was sunsetted, this represents a temporal abandonment failure: the 'fake source' capability may have been intended to receive authentication later, but that work never happened because attention moved on. No one was maintaining this build when it reached production. The CVSS 5.3 score significantly understates real-world risk. This is not a technical complexity vulnerability — it's a trust infrastructure failure. The capability can falsify 'source' metadata that downstream systems likely treat as authoritative for analytics, compliance logging, and audit trails. If your deployment consumes Rush data and trusts source metadata without verification, a single unauthenticated request can corrupt every record that flows from it. The blast radius extends far beyond the Rush instance itself. Check whether you are running an IKAS Rush build with a future-dated version string — if so, you are likely on unsupported, abandoned code with no patch coming. The remediation ceiling is removal, not patching. Segment the affected system from any network path that could allow external unauthenticated access, and treat any data from it as potentially falsified if source provenance matters for your compliance or analytics pipelines.

Reviewed through automated stages and approved by a human before publication.