CVE-2026-123017
Description
A flaw was found in GodotSteam. The multiplayer networking component fails to validate peer identification numbers provided during initial connection handshakes, allowing a connected player to claim the designated server identity. A remote attacker participating in a multiplayer session can exploit this vulnerability to impersonate the game server, enabling the execution of unauthorized server commands or the interception of game communications from other participants.
Statement
This vulnerability is evaluated as Moderate severity because an attacker must already be an active peer in a multiplayer session, and the blast radius is confined to forging in-game authority commands without providing broader operating system access or host-level code execution. GodotSteam is not included in Red Hat Enterprise Linux or any other Red Hat product offerings. As this component is not distributed or supported by Red Hat, default enterprise deployments are unaffected by this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
