# GREENmod pipe ACL flaw enables SSRF

Published: 2026-04-17 · Severity: medium
Canonical: https://vorant.io/reports/df7d46ea-e0cf-5235-9cb3-2eae2d0b0442/greenmod-pipe-acl-flaw-enables-ssrf

> CVE-2026-5131 in GREENmod allows unprivileged attackers to exploit misconfigured named pipe ACLs for SSRF attacks against Windows systems via SMB or WebDav; patched in v2.8.33.

CERT Polska disclosed CVE-2026-5131, a vulnerability in GREENmod software stemming from incorrectly configured access control lists on named pipes used for inter-component communication. The flaw allows local attackers to interact with these pipes and upload arbitrary XML or JSON files that are processed with the privileges of the service account. This design weakness enables Server-Side Request Forgery (SSRF) attacks against any Windows system running the GREENmod agent that supports SMB or WebDav communication.

The vulnerability was responsibly disclosed by security researcher Marcin Ressel and has been addressed by the vendor in GREENmod version 2.8.33. Organizations running affected versions should prioritize upgrading to the patched release. The issue represents a privilege escalation and lateral movement risk in environments where GREENmod is deployed, as attackers with local access can leverage the service's elevated privileges to perform unauthorized network operations.

## Mentioned in this report

- Vulnerabilities: CVE-2026-5131

## Detection guidance (public sample)

### Non-Service Process Connecting to GREENmod IPC Named Pipe

ATT&CK: T1068

Detects a process other than the expected GREENmod service binary opening or connecting to a GREENmod named pipe, consistent with exploitation of CVE-2026-5131 (misconfigured pipe ACLs) to submit malicious XML/JSON payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-Service Process Connecting to GREENmod IPC Named Pipe
id: b2c18d66-69a0-5bfa-8a28-287796d44321
status: experimental
description: Detects a process other than the legitimate GREENmod service binary connecting
  to a GREENmod-related named pipe, which may indicate exploitation of CVE-2026-5131
  (weak pipe ACLs) to inject XML/JSON content processed with service privileges.
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains: greenmod
  filter:
    Image|contains:
    - \GreenMod\
    - \Program Files\GreenMod
  condition: selection and not filter
falsepositives:
- Legitimate GREENmod agent processes installed in non-default directories
- Third-party monitoring or backup agents that legitimately hook into GREENmod IPC
  channels
level: high
tags:
- attack.t1068
- attack.privilege_escalation
author: Vorant
```

### GREENmod Agent Initiating Outbound SMB or WebDAV Connection (Possible SSRF)

ATT&CK: T1071.002

Detects the GREENmod agent process making outbound SMB or WebDAV connections, consistent with SSRF abuse of CVE-2026-5131 where attacker-supplied pipe input causes the service to issue unauthorized network requests. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GREENmod Agent Initiating Outbound SMB or WebDAV Connection
id: 0135c7d1-7e73-5f1b-8540-92ab37266389
status: experimental
description: Detects the GREENmod agent process establishing outbound connections
  to SMB (445/139) or WebDAV (80/443 via WebClient) endpoints, which may indicate
  SSRF exploitation of CVE-2026-5131 where a locally injected named-pipe payload causes
  the service to reach attacker-controlled or unintended internal/external hosts.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains: greenmod
    Initiated: 'true'
    DestinationPort:
    - 445
    - 139
    - 80
    - 443
  condition: selection
falsepositives:
- Normal GREENmod agent traffic to its configured management or update servers over
  SMB/HTTP
- Legitimate file share or WebDAV integrations configured as part of GREENmod functionality
level: medium
tags:
- attack.t1071.002
- attack.command_and_control
author: Vorant
```

### Suspicious Child Process Spawned by GREENmod Service

ATT&CK: T1068

Detects command interpreters or scripting engines spawned by the GREENmod service process, indicating potential post-exploitation after abusing the named-pipe ACL flaw to execute code with service-account privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by GREENmod Service
id: d15ca6ed-d5d6-5c4b-9f22-12371f58282d
status: experimental
description: Detects command shells or scripting interpreters launched as children
  of the GREENmod service process, which may indicate successful privilege escalation
  via CVE-2026-5131 after abusing a misconfigured named pipe to run arbitrary code
  with elevated service privileges.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: greenmod
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \wscript.exe
    - \cscript.exe
    - \rundll32.exe
    - \mshta.exe
  condition: selection
falsepositives:
- Legitimate administrative scripts intentionally invoked by GREENmod maintenance
  tasks
- Scheduled update or diagnostic routines that call scripting engines from the service
  context
level: high
tags:
- attack.t1068
- attack.privilege_escalation
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-5131

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/df7d46ea-e0cf-5235-9cb3-2eae2d0b0442/greenmod-pipe-acl-flaw-enables-ssrf.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup