Medium severity · published Oct 4, 2026
CVE-2026-105161
invariant-systems-ai aiir Policy Gate signature verification
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade the affected component. The GitHub repository of this project is not available anymore. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiir · invariant-systems-ai
1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +2 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105161
vdb-entry
https://vuldb.com/vuln/413387
signature
https://vuldb.com/vuln/413387/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-105161
issue-tracking
https://github.com/advisories/GHSA-73p9-6hrp-8qhr
broken-link
https://github.com/invariant-systems-ai/aiir/security/advisories/GHSA-73p9-6hrp-8qhr
broken-link
https://github.com/invariant-systems-ai/aiir/