CVE-2026-30805 is a critical flaw (CVSS 9.1) in Artica Pandora FMS. An insecure default initialization of a resource allows authentication bypass through API access in versions 777 through 800. The record does not name a fixed version, so check the vendor's security page for the current guidance.
What's affected
The NVD record says Pandora FMS from version 777 through 800 is affected. It does not name a fixed version. The vendor lists its security notices at pandorafms.com under Common Vulnerabilities and Exposures. That page did not return readable content when it was fetched for this article, so treat the advisory there as the authority and confirm the fixed release before you plan.
The flaw concerns API access, so installations that expose the Pandora FMS API to other networks are at the front of the queue.
How to check if you're exposed
Find your Pandora FMS version in the web console, usually shown in the footer or in the About page. Compare it with the 777 through 800 range. Then identify who can reach the API. Check the web server and firewall rules for the Pandora FMS host and note whether the API path is reachable from outside your management network. Review the API settings in the console, including any API password or allowed address list, since the weakness is described as an insecure default.
What to do now
- Open the vendor's security page and confirm the fixed version, then upgrade to it.
- Limit API access to the addresses that need it, such as your management network or specific automation hosts.
- Review API settings in the console and replace default or empty values with strong ones.
- Check access logs for API requests from unknown sources.
- Keep your monitoring server off the public internet where you can, since it holds credentials and a map of your estate.
Why it matters
The record files this under CWE-1188, insecure default initialization of a resource. The software shipped, or set up, a resource in a state that is easier to use but not safe, and the API path allowed access without proper authentication as a result. Insecure defaults are easy to miss, since the system works and nobody changes the setting.
A monitoring platform is an attractive target, because it knows about your hosts and often stores credentials for them. The record has few details, so rely on the vendor for exact steps. The record does not mark this as exploited in the wild.
Quick check
Is there a fixed version?
The record does not say. Check the vendor's security notices page.
Who is at risk?
Installs with a version between 777 and 800 where the API can be reached by untrusted users.
Sources
Last reviewed: 19 October 2026.
