Two chained N-central bugs hand an unauthenticated caller a System administrator account

The trust model does the damage. N-central gives requests that appear to come from 127.0.0.1 more access than remote ones, and that judgement is made independently by three components that each parse the same request: Envoy at the edge, Jetty behind it, and N-central's own access filter ^[7]. Rapid7's request breaks the agreement in two places at once, with a semicolon in the URI and a backslash inside the Forwarded header value ^[8][9].

The path half is documented end to end. Envoy's management listener, shipped in the n-central-proxy-4.5.6-5 package, answers 403 to anything beginning /dms/services or /internal/dms and sends everything else to the DMS cluster on a catch-all rule ^[10]. The string /dms;/services/ServerUI does not begin with /dms/services, because the character after /dms is a semicolon, so it takes the catch-all and reaches Jetty ^[11]. Jetty 9.4.56 then treats text beginning with a semicolon as a path parameter and removes it when it builds the decoded path for servlet dispatch, yielding /dms/services/ServerUI ^[12], which matches the Axis SOAP servlet mapping ^[13]. Rapid7 shows the same move against the second mapping as /internal;/dms/services2/ServerUI2 ^[14]. Both denylisted prefixes in the published config fall to one character ^[15].

The published analysis shows less than it claims. The technical detail available covers CVE-2026-86206; the role of CVE-2026-86207 and the mechanics of creating the account are given as the outcome of the chain rather than walked through ^[18]. Rapid7 attributes the second disagreement, over whether the client is really local, to the escaped Forwarded value ^[9]. There is no claim of exploitation in the wild, no CVSS score, and no disclosure dates ^[17]. The credited researcher is Stephen Fewer of Rapid7 ^[5].

For defenders the durable artefact is the string. A legitimate client has no reason to request a path with a semicolon immediately after /dms or /internal on the management interface, TCP 8443 by default ^[6], so those requests in proxy logs stand out as a clear signature ^[19].

The remediation is a hotfix under a release name that does not change, so a server reporting 2026.3 tells an operator nothing about whether it is exploitable ^[21]. On an N-central short of Hotfix 3, the account list is where the chain leaves its mark: a System administrator nobody in the shop created ^[2][3].