Vulnerability · Published Oct 4, 2026 · Assigned by VulDB

CVE-2026-105161invariant-systems-ai aiir Policy Gate signature verification

Medium 5.3

In plain English

A medium-severity insufficient verification of data authenticity in aiir from invariant-systems-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade the affected component. The GitHub repository of this project is not available anymore. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products (as reported)

Vendor	Product	Versions
invariant-systems-ai	aiir	1.01.11.21.31.41.51.61.7.0

Weakness: CWE-347, CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References

VDB-413387 | invariant-systems-ai aiir Policy Gate signature verification vdb-entry
VDB-413387 | CTI Indicators (IOB, IOC) signature, permissions-required
CVE-2026-105161 | CVE Analysis and Report third-party-advisory
https://github.com/advisories/GHSA-73p9-6hrp-8qhr issue-tracking
https://github.com/invariant-systems-ai/aiir/security/advisories/GHSA-73p9-6hrp-8qhr broken-link
https://github.com/invariant-systems-ai/aiir/ broken-link, product