Is CVE-2026-85213 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85213?

CVE-2026-85213 has a CVSS v3 severity of HIGH (7.6).

Back

CVE-2026-85213

Description

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.