Search/CVE-2026-61854
● CVE — High

CVE-2026-61854

DiscoveredOct 30, 2026UpdatedOct 30, 2026

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In report_buffer.py, _maybe_cleanup() uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous _cleanup_tenant() operations for one tenant. Cleanup reads transcripts.jsonl and rewrites it in place without file locking or atomic replacement, while report_buffer_append_async uses asyncio.to_thread to append without synchronization. In main.py, concurrent _processing_worker tasks make this reachable in normal operation; processing.worker_count of two or more and public-pool servers sharing a server_key increase collisions. With report_buffer.enabled set to true,…

CVSS v3.1
8.2 HIGH
EPSS
—%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityLOW
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Connections
3 relationships
Timeline
disclosure → media coverage
Oct 30, 2026
Disclosure — published as a CVE record.