Cyber Posture

CVE-2026-41588

Critical

Published: 08 May 2026

Published
08 May 2026
Modified
08 May 2026
KEV Added
—
Patch
—
CVSS Score 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0001 2.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41588 is a critical-severity Observable Timing Discrepancy (CWE-208) vulnerability. Its CVSS base score is 9.0 (Critical).

Operationally, ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-30 Concealment and Misdirection
addresses: CWE-208

Timing randomization or delays can mask true operation timing and mislead timing-based attacks.

SC-31 Covert Channel Analysis
addresses: CWE-208

Observable timing discrepancies are a primary mechanism for constructing covert timing channels; analysis identifies and bounds them, limiting exploitation.

NVD Description

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-208

CVEs Like This One

CVE-2026-28464Shared CWE-208
CVE-2025-68621Shared CWE-208
CVE-2026-5086Shared CWE-208
CVE-2025-70949Shared CWE-208
CVE-2025-48630Shared CWE-208
CVE-2026-40972Shared CWE-208
CVE-2024-42512Shared CWE-208
CVE-2026-23519Shared CWE-208
CVE-2024-13939Shared CWE-208

References