EagleCloud Aquila: Code injection in Pigeon MFA service

Summary

The Pigeon MFA service in EagleCloud Aquila on-premises deployments up to version 2.6.7.2 contains a code injection flaw (CWE-94). An authenticated attacker, or one with low privileges, can persistently inject Lua scripts through an improperly restricted API endpoint, and the backend engines then evaluate them. Successful exploitation can lead to remote code execution as container root, authentication bypass and disclosure of sensitive deployment keys. The CVSS 4.0 base score is 9.4 (critical).

Affected

• EagleCloud Aquila on-premises, versions 0 to 2.6.7.2 (according to the CVE record)

Fixed in

• Version 2.6.7.3, according to the timeline in Mandiant's advisory
• EagleCloud's own advisory was not available to confirm this fix

Workaround

Unknown. No vendor-issued workaround found.

• Restrict access to the Aquila management and MFA interfaces until the update is applied

Exploitation

• No evidence of active exploitation found
• Not listed in KEV according to Strix
• No public proof of concept found

Our recommendation

• Inventory all Aquila on-premises instances and their versions
• Ask EagleCloud to confirm version 2.6.7.3 and provide its official advisory
• Upgrade to the confirmed fixed version, then review accounts and logs for unexpected changes
• Limit network access to the MFA and management interfaces

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Mandiant advisory MNDT-2026-0039 github.com
• VulDB entry CVE-2026-104383 vuldb.com
• Strix CVE entry CVE-2026-104383 www.strix.ai
• Vulners CVE entry CVE-2026-104383 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:43.