CVE-2026-57948: Microsoft APM insecure JWT cookie

CISO Take

Pinpoint (the APM monitoring tool) through version 3.1.0 issues its `pinpointJwt` session cookie without the HttpOnly and Secure flags, meaning any XSS on the same origin can read the token via `document.cookie` and any HTTP (non-TLS) request can leak it to a network eavesdropper. This is not a standalone remote exploit — it requires a stored/reflected XSS bug or a man-in-the-middle position, which is reflected in the high attack complexity (CVSS 6.8, AC:H) and negligible EPSS score (0.126%, though still ranked in the top 97% percentile of scored CVEs, so treat the percentile as noise here, not urgency). There is no public PoC, no Nuclei template, and it is not in CISA KEV, so this is a hardening gap rather than an active threat. Blast radius is currently 0 tracked downstream dependents, but Pinpoint is an APM platform frequently deployed in front of production Java/microservice stacks (including AI inference services), so a hijacked session could expose live traces and infra topology. Action: upgrade past 3.1.0 once a patched release ships, and in the interim add HttpOnly/Secure/SameSite attributes at the reverse proxy (Caddy/Nginx) or via a `Set-Cookie` rewrite, enforce HTTPS-only access to the Pinpoint web console, and monitor for any XSS findings in the Pinpoint UI that would make this exploitable.

Sources: NVD EPSS GitHub Advisory

What is the risk?

Medium severity per CVSS (6.8) driven by high confidentiality and integrity impact if exploited, but tempered by high attack complexity and required user interaction — this is a defense-in-depth gap, not a directly exploitable network vulnerability. No KEV listing, no public exploit code, and an EPSS score near-zero (0.00126) confirm real-world exploitation is currently unlikely. The real risk is compounding: it only becomes dangerous when paired with a separate XSS vulnerability in the Pinpoint web UI or when the console is accessed over unencrypted HTTP on a shared/untrusted network.

How does the attack unfold?

Initial Access

Attacker exploits a stored/reflected XSS in the Pinpoint web console or positions themselves on the same network to intercept unencrypted HTTP traffic.

Credential Theft

The missing HttpOnly flag allows JavaScript to read the pinpointJwt cookie via document.cookie, or the missing Secure flag exposes it in cleartext over HTTP.

AML.T0055

Session Hijacking

Attacker replays the stolen pinpointJwt token to impersonate the legitimate administrator and gain authenticated access to the Pinpoint console.

AML.T0012

Impact

Attacker reads APM traces, service topology, and monitoring metadata for instrumented systems, including any AI/ML services monitored by Pinpoint.

Initial Access

Attacker exploits a stored/reflected XSS in the Pinpoint web console or positions themselves on the same network to intercept unencrypted HTTP traffic.

Credential Theft

The missing HttpOnly flag allows JavaScript to read the pinpointJwt cookie via document.cookie, or the missing Secure flag exposes it in cleartext over HTTP.

AML.T0055

Session Hijacking

Attacker replays the stolen pinpointJwt token to impersonate the legitimate administrator and gain authenticated access to the Pinpoint console.

AML.T0012

Impact

Attacker reads APM traces, service topology, and monitoring metadata for instrumented systems, including any AI/ML services monitored by Pinpoint.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Microsoft APM	pip	—	No patch
3.5K Pushed 5d ago 67% patched ~7d to patch Full package profile →

Do you use Microsoft APM? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade Pinpoint beyond 3.1.0 once an upstream fix is released (track the linked GitHub issue #13858). 2) Until patched, enforce the Secure and HttpOnly flags on the pinpointJwt cookie via a reverse proxy header rewrite (Caddy header directive or Nginx proxy_cookie_flags). 3) Force HTTPS-only access to the Pinpoint web console (HSTS, redirect HTTP to HTTPS, disable plaintext listener). 4) Add SameSite=Strict/Lax to reduce CSRF-adjacent risk alongside the cookie fix. 5) Audit the Pinpoint web UI for any XSS vulnerabilities, since this cookie flaw is only exploitable in combination with one. 6) Monitor Pinpoint session/auth logs for anomalous session reuse from unexpected IPs as a hijacking indicator.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Inference AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

GOVERN 1.5 - Ongoing monitoring and periodic review of risk management processes

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-57948?

Pinpoint (the APM monitoring tool) through version 3.1.0 issues its `pinpointJwt` session cookie without the HttpOnly and Secure flags, meaning any XSS on the same origin can read the token via `document.cookie` and any HTTP (non-TLS) request can leak it to a network eavesdropper. This is not a standalone remote exploit — it requires a stored/reflected XSS bug or a man-in-the-middle position, which is reflected in the high attack complexity (CVSS 6.8, AC:H) and negligible EPSS score (0.126%, though still ranked in the top 97% percentile of scored CVEs, so treat the percentile as noise here, not urgency). There is no public PoC, no Nuclei template, and it is not in CISA KEV, so this is a hardening gap rather than an active threat. Blast radius is currently 0 tracked downstream dependents, but Pinpoint is an APM platform frequently deployed in front of production Java/microservice stacks (including AI inference services), so a hijacked session could expose live traces and infra topology. Action: upgrade past 3.1.0 once a patched release ships, and in the interim add HttpOnly/Secure/SameSite attributes at the reverse proxy (Caddy/Nginx) or via a `Set-Cookie` rewrite, enforce HTTPS-only access to the Pinpoint web console, and monitor for any XSS findings in the Pinpoint UI that would make this exploitable.

Is CVE-2026-57948 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57948, increasing the risk of exploitation.

How to fix CVE-2026-57948?

1) Upgrade Pinpoint beyond 3.1.0 once an upstream fix is released (track the linked GitHub issue #13858). 2) Until patched, enforce the Secure and HttpOnly flags on the `pinpointJwt` cookie via a reverse proxy header rewrite (Caddy `header` directive or Nginx `proxy_cookie_flags`). 3) Force HTTPS-only access to the Pinpoint web console (HSTS, redirect HTTP to HTTPS, disable plaintext listener). 4) Add SameSite=Strict/Lax to reduce CSRF-adjacent risk alongside the cookie fix. 5) Audit the Pinpoint web UI for any XSS vulnerabilities, since this cookie flaw is only exploitable in combination with one. 6) Monitor Pinpoint session/auth logs for anomalous session reuse from unexpected IPs as a hijacking indicator.

What systems are affected by CVE-2026-57948?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks.

What is the CVSS score for CVE-2026-57948?

CVE-2026-57948 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

model servingagent frameworks

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

Compliance Controls Affected

NIST AI RMF: GOVERN 1.5

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.

Exploitation Scenario

An attacker first identifies or plants a stored/reflected XSS vector in the Pinpoint web console (e.g., a crafted trace name, alert message, or comment field rendered unsanitized). A victim administrator with an active Pinpoint session visits or interacts with the malicious content, and the injected script reads `document.cookie`, exfiltrating the `pinpointJwt` token to an attacker-controlled endpoint because the cookie lacks HttpOnly. Alternatively, if the Pinpoint console is accessed over plain HTTP on a shared network (office Wi-Fi, cloud VPC without enforced TLS), the attacker sniffs the cookie in transit since it lacks the Secure flag. With the stolen token, the attacker replays it to impersonate the administrator, gaining read access to APM traces and topology data for any instrumented services, including AI inference or agent backends monitored by Pinpoint.

Weaknesses (CWE)

CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag: The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.