Vulnerability · Published Jun 18, 2026 · Assigned by cisa-cg
CVE-2026-54106U.S. GAO EPDS and CBCA EDS network access control bypass
Medium 4.7
In plain English
A medium-severity security flaw in Electronic Docketing System (EDS) from Civilian Board of Contract Appeals. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.5%top 57.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Government Accountability Office | Electronic Protest Docketing System (EPDS) | 0 – before 2026-02-22 |
| Civilian Board of Contract Appeals | Electronic Docketing System (EDS) | 0 – before 2026-03-19 |
Weakness: CWE-940 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L