CVE-2026-103101 is a High severity denial of service in the web server of Pexip Infinity, the video conferencing platform. Versions 30.0 through 40.x before 41.0 are affected, and a remote attacker can render a node inaccessible. The vendor's resolution is to upgrade to version 41.0, with no mitigation listed.
What's affected
- Product: Pexip Infinity, the video conferencing platform from Pexip.
- Affected: 30.0 through 40.x before 41.0 in the record; the vendor bulletin gives the range as 30 to 40.1.
- Fixed: Pexip Infinity v41.0.
- Vendor mitigation: none listed in the security bulletin.
- Vendor score: CVSS 3.1 base score 8.6, which matches the record, and the bulletin rates it High.
Source note: the record and the vendor bulletin agree on severity (8.6, High) and on the fix. They phrase the affected range slightly differently, 40.x in the record against 40.1 in the bulletin. If you run any 40.x build, treat it as affected and upgrade, and confirm exact build details with the vendor.
How to check if you're exposed
Pexip Infinity is an appliance style product, so there is no package manager check. Use the platform's own administration views.
- Sign in to the Infinity Management Node and open the list of conferencing nodes.
- Note the software version shown for each node, including any in cloud or remote locations.
- Compare each version with the affected range, 30.0 through the 40.x line.
- Check which nodes expose their web interface to untrusted networks, such as the internet or a guest network.
If you buy Infinity through a reseller or a managed service, ask them which version your deployment runs and when they will move to v41.0. Record the answer in your asset inventory so the follow up is not lost.
The vendor's security bulletin page is the authority on affected builds, and it is worth reading directly: docs.pexip.com/admin/security_bulletins.htm.
What to do now
- Find every Pexip Infinity node and its version, including cloud hosted ones.
- Plan the upgrade to v41.0 following Pexip's upgrade documentation, node by node, and schedule it outside busy meeting hours.
- Until you upgrade, limit who can reach the web interfaces of the nodes. The bulletin lists no mitigation, so network level restriction is a general precaution, not a vendor fix.
- Tell the meeting operations team about the risk and the maintenance window, since a node taken offline affects live calls.
- After the upgrade, confirm the new version on every node and close the ticket with the evidence.
- Subscribe to the vendor's security bulletins so the next advisory reaches the right team.
Why it matters
The record lists the weakness as CWE-770, allocation of resources without limits or throttling, and the vendor describes it as insufficient input validation in the web server. Either way the effect is availability: a remote, unauthenticated request can make a node unreachable. The score of 8.6 reflects a network attack that needs no privileges or user action.
For a conferencing platform, availability is the product. A node that stops answering ends calls and blocks new ones. An outage can also land at an awkward time, so planning the move to v41.0 ahead of any incident is the better route.
The record does not list this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. The same bulletin lists several other issues fixed in v41.0, so the upgrade closes more than this one.
Quick check
Is there a workaround?
The vendor bulletin lists no mitigation for this issue and gives upgrading to Pexip Infinity v41.0 as the resolution.
Does this expose meeting content?
The record describes an availability impact only, which is a node becoming inaccessible. It does not describe data disclosure.
Sources
Last reviewed: 18 October 2026.
