What is the official website of Tata Steel ?

The official website of Tata Steel is https://www.tatasteel.com.

What is Tata Steel's cybersecurity risk score?

Tata Steel has an AI-generated cybersecurity risk score of 695 out of 1000, indicating a Weak security posture according to Rankiteo's assessment.

How many security incidents has Tata Steel experienced?

According to Rankiteo, Tata Steel currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Tata Steel been affected by any supply chain cyber incidents ?

According to Rankiteo, Tata Steel has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: Tata Group (Incident ID: TATRED1782606562) Tata Group (Incident ID: MIC1773923106) Tata Group (Incident ID: MAR1193411110425) Cellebrite (Incident ID: DELOPETATAPPCELCOU1782491615)

Does Tata Steel have SOC 2 Type 1 certification ?

According to Rankiteo, Tata Steel is not certified under SOC 2 Type 1.

Does Tata Steel have SOC 2 Type 2 certification ?

According to Rankiteo, Tata Steel does not hold a SOC 2 Type 2 certification.

Does Tata Steel comply with GDPR ?

According to Rankiteo, Tata Steel is not listed as GDPR compliant.

Does Tata Steel have PCI DSS certification ?

According to Rankiteo, Tata Steel does not currently maintain PCI DSS compliance.

Does Tata Steel comply with HIPAA ?

According to Rankiteo, Tata Steel is not compliant with HIPAA regulations.

Does Tata Steel have ISO 27001 certification ?

According to Rankiteo,Tata Steel is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Tata Steel operate in ?

Tata Steel operates primarily in the Mining industry.

How many employees does Tata Steel have ?

Tata Steel employs approximately 58,871 people worldwide.

Does Tata Steel own any subsidiaries ?

Tata Steel presently has no subsidiaries across any sectors.

How many LinkedIn followers does Tata Steel have ?

Tata Steel's official LinkedIn profile has approximately 2,409,267 followers.

What is the NAICS classification code for Tata Steel ?

Tata Steel is classified under the NAICS code 212, which corresponds to Mining (except Oil and Gas).

Does Tata Steel have a Crunchbase profile ?

No, Tata Steel does not have a profile on Crunchbase.

Does Tata Steel have a LinkedIn profile ?

Yes, Tata Steel maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/tatasteelltd.

How many cybersecurity incidents has Tata Steel experienced ?

As of August 2, 2026, Rankiteo reports that Tata Steel has experienced 11 cybersecurity incidents.

How many peer or competitor companies does Tata Steel have ?

Tata Steel has an estimated 3,811 peer or competitor companies worldwide.

What types of cybersecurity incidents has Tata Steel faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach, Ransomware, Cyber Attack and Vulnerability.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Tata Steel

Boost Score +25 with badge (5 left)

695

/1000

Weak

720

/1000

Moderate

Tata Steel Vendor Cyber Rating & Cyber Score

tatasteel.com

Add Your Compliance Badge

Tata Steel is one of the world’s most diversified integrated steel producers, with a capacity of 35 million tonnes per annum (MTPA) across India, the Netherlands, the UK, and Thailand. The World Economic Forum has recognised Tata Steel’s Jamshedpur, Kalinganagar and IJmuiden plants as Manufacturing Lighthouses. With over 76,000 employees worldwide, Tata Steel is a Great Place to Work®-certified organisation. In India, Tata Steel operates in Jamshedpur and Gamharia in Jharkhand, and in Kalinganagar (including Neelachal Ispat Nigam Limited) and Meramandali in Odisha, with an overall capacity of 26.6 MTPA. The Company has captive mining operations in India, including collieries in Jharia and West Bokaro, as well as iron ore mines in

Tata Steel A.I CyberSecurity Scoring

Scoring History

Tata Steel

Tata Steel CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Tata Steel

Ransomware

100

7/2026

TATBAN178522807...

Tata Group

Breach

6/2026

Tata Group

TATRED178260656...

Tata Group

Vulnerability

100

1/2026

Tata Group

MIC1773923106

Tata Steel

Cyber Attack

100

11/2025

TAT066210611172...

Tata Group

Ransomware

100

9/2025

Tata Group

MAR119341111042...

Tata Steel

Breach

100

5/2025

TAT203292010312...

Tata Steel

Ransomware

100

4/2025

TAT235040325

Tata Steel Nederlan...

Ransomware

100

2/2025

TAT1777667117

Tata Steel

Ransomware

1/2025

TAT702030425

Industrial By-Produ...

Breach

100

1/2025

Cellebrite

DELOPETATAPPCEL...

Tata Steel

Ransomware

10/2022

TAT000020325

Loading…

A.I.

Tata Steel Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Tata Steel

Incidents vs Mining Industry Avg (This Year)

Tata Steel has 58.33% fewer incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

Tata Steel has 2.91% fewer incidents than the average of all companies with at least one recorded incident.

Incident Types Tata Steel vs Mining Industry Avg (This Year)

Tata Steel reported 1 incidents this year: 0 cyber attacks, 1 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.

Incident History - Tata Steel (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Tata Steel Subsidiaries

Tata Steel

Mining

Website: https://www.tatasteel.com

Company Size: 10,001+ employees

Tata GroupExecutive Offices

Tata Consultancy ServicesIT Services and IT Consulting

Tata Consultancy Services - Latin AmericaInformation Technology & Services

Tata Consultancy Services - UK and IrelandIT Services and IT Consulting

Tata Consultancy Services - North AmericaIT Services and IT Consulting

Tata Consultancy Services - ResearchResearch Services

TCS AI & Advanced TechIT Services and IT Consulting

TCS Digital Software & SolutionsIT Services and IT Consulting

Tata Consultancy Services – Asia PacificIT Services and IT Consulting

Tata Consultancy Services - IndiaIT Services and IT Consulting

TCS BaNCSIT Services and IT Consulting

Tata Consultancy Services - EuropeIT Services and IT Consulting

Future-Ready ManufacturingManufacturing

Tata Consultancy Services - JapanIT Services and IT Consulting

Tata Consultancy Services - Middle East & AfricaIT Services and IT Consulting

TCS Life Sciences and HealthcareIT Services and IT Consulting

TCS Financial Services and InsuranceIT Services and IT Consulting

TCS Retail and Consumer GoodsIT Services and IT Consulting

Tata CapitalFinancial Services

Tata TechnologiesEngineering Services

iGETIT by Tata Technologies | Learning Solutions for EngineersE-learning

Taj HotelsHospitality

Taj InnerCircleHospitality

Tata MotorsMotor Vehicle Manufacturing

Bolt from Tata MotorsMotor Vehicle Manufacturing

Tata Housing Development Company LimitedReal Estate

Tata International LimitedInternational Trade and Development

CMC LTDIT Services and IT Consulting

Tata Mutual FundFinancial Services

Prof.Simply SimpleFinancial Services

Tata Group - EuropeIndustrial Machinery Manufacturing

Tata HealthWellness and Fitness Services

Roz Ka DozHealth, Wellness & Fitness

Tata ElxsiIT Services and IT Consulting

Tata Elxsi Healthcare and Life SciencesIT Services and IT Consulting

Tata Elxsi TransportationIT Services and IT Consulting

Tata Elxsi Media & CommunicationsIT Services and IT Consulting

Tata Elxsi JapanIT Services and IT Consulting

Tata Elxsi Design StudioIT Services and IT Consulting

Titan Company LimitedRetail

Titan Corporate GiftingRetail

Titan Watches IndiaManufacturing

Design Impact IndiaCivic and Social Organizations

Titan Precision ToolsMachinery Manufacturing

Xylys WatchesManufacturing

Titan MovementsRetail Luxury Goods and Jewelry

Steel Recycling Business, Tata SteelMining

Tata Steel Industrial ConsultingOperations Consulting

KalzipBuilding Materials

Tata Pravesh - Doors and WindowsFurniture and Home Furnishings Manufacturing

Loading…

Tata Steel Similar Companies

AngloGold Ashanti

cb anglogoldashanti.com

AngloGold Ashanti plc is a global gold mining company with a diverse, high-quality portfolio of operations, projects and exploration activities across 10 countries on four continents. We pursue value-creating opportunities involving other minerals, where we can leverage our existing assets, shareholdings, skills and experience. AngloGold Ashanti Limited was formed in June 1998 with the consolidation of the gold mining interests of Anglo American plc. Following the combination of AngloGold and Ashanti Goldfields Company Limited, the company was renamed AngloGold Ashanti Ltd in April 2004. It became AngloGold Ashanti plc in September 2023 after implementing a corporate restructure which included a change in domicile to the United Kingdom. AngloGold Ashanti has a portfolio of assets in the world’s key gold producing regions: Tanzania, the DRC, Ghana, Guinea, Egypt, Australia, the USA, Brazil, Argentina and Colombia. It has a track record of greenfields and brownfields exploration success. The company's primary listing is on the New York Stock Exchange and its headquarters are in Denver, Colorado in the USA. It is also listed on the South Africa and Ghana stock exchanges.

CSN - Companhia Siderúrgica Nacional

csn.com.br

Fundada em 1941, a CSN representa um marco no processo de industrialização do Brasil. O seu aço viabilizou a implantação das primeiras indústrias nacionais, núcleo do atual parque fabril brasileiro. Ao longo de mais de oito décadas, a CSN segue fazendo história, sendo hoje um dos mais eficientes complexos siderúrgicos integrados do mundo, com atuação em cinco segmentos estratégicos da economia: Siderurgia, Mineração, Logística, Cimentos e Energia. Atualmente, entre seus ativos, a empresa conta com uma usina siderúrgica integrada; cinco unidades industriais, sendo duas delas no exterior; minas de minério de ferro, calcário, dolomita e estanho; uma forte distribuidora de aços planos; terminais portuários; participações em ferrovias; somos a 2ª maior produtora de cimentos do Brasil, com uma capacidade de 16,3 mtpa; e temos participação em usinas hidrelétricas distribuídas pelo Brasil. Com uma gestão firme e inovadora, a empresa valoriza a força empreendedora do capital nacional e o enorme potencial brasileiro de competitividade no setor siderúrgico. Multinacional com orgulho de ser brasileira, a empresa acredita e investe no país. Com a força do trabalho de seus mais de 30 mil colaboradores, enfrenta com sucesso os desafios da economia globalizada. JUNTE-SE À CSN! A Companhia Siderúrgica Nacional busca atrair e desenvolver profissionais que se identifiquem com a sua cultura, valorizando sempre a diversidade. Venha você também fazer parte da história do maior complexo siderúrgico da América Latina, um grupo que tem como essência “fazer bem, fazer mais e fazer para sempre”.

ArcelorMittal Nippon Steel India

cb amns.in

AM/NS India is a joint venture between the world's leading steel companies, ArcelorMittal and Nippon Steel. Established in December 2019, post-acquisition of Essar Steel, we are an integrated flat steel manufacturer - from iron ore to ready-to-market products. With over 300 steel grades - many substituting imports, we serve an array of contemporary industries (agriculture, automotive, infrastructure, defence, energy, etc.) and contribute to an Aatmanirbhar Bharat. Our portfolio encapsulates hot rolled coils / sheets / plates, cold rolled coils / sheets, galvanized coil / sheets, pre-painted galvanized coil / sheets, pipelines, etc. We ascribe to advancement with sustainability and envision creating 'Smarter Steels, Brighter Futures'. Our vision has nestled in empowering communities by providing employment to more than 16,00,000 individuals and enriching millions of lives across the country through our CSR interventions. We are inspired by ArcelorMittal's XCarb programme and Nippon Steel's Zero Carbon initiative and stand in alignment with India's vision to be carbon-neutral by 2070. Our recent partnership with Greenko for renewable power and storage facility is a notable step in that direction. Our MoUs with National Small Industries Corporation and National Skill Development Corporations are devised to bolster the MSME ecosystem in India. We prioritize health and safety and foster a culture of innovation by placing research and development at the heart of our operations. We are a committed partner to the nation, and our avid growth story will be purposeful, inclusive, and sustainable.

Orica

cb orica.com

Our story began in 1874, when we first supplied explosives to the Victorian goldfields in Australia. Since then, we have grown to become one of the world’s leading mining and infrastructure solutions providers. From the production and supply of explosives, blasting systems, mining chemicals and geotechnical monitoring to our cutting-edge digital solutions and comprehensive range of services, we sustainably mobilise the earth’s resources. With 150 years of expertise, our 14,000+ community of engineers, scientists, technologists, operators, business specialists and on-site crew support customers in surface and underground mines, quarry, construction, and oil and gas operations. Sustainability is integral to our operations. Our approach to sustainability begins with ensuring we operate our business responsibly, and by prioritising the safety of our people, customers, and communities. We are in a unique position to leverage our expertise in technology to create safer and more responsible solutions and deliver positive economic, social, and environmental contributions through our business activities.

First Quantum Minerals

first-quantum.com

First Quantum Minerals Ltd. is a global mining company producing copper and nickel, as well as gold and cobalt. Our growing portfolio of operations and projects spans four continents and employs around 20,000 people. We are well-known for our ‘can do’ attitude and specialist technical, project management, engineering, construction and operational skills, which allow us to develop and successfully run complex mines and minerals processing plants. We strive to go beyond the goals set by other companies. After 25 years of operations we are now one of the world’s top 10 copper producers and we focus on providing a tangible benefit from everything we do for employees, investors and the many communities that host our operations. From our initial operation reprocessing tailings facilities in Zambia, to the recently completed giant Cobre Panama operation, we have recorded many significant commercial and technical achievements over the past two decades. By 2021, the combined output of our mines will be more than 800,000 tonnes of copper per year.

Norsk Hydro

hydro.com

Hydro is a leading industrial company that builds businesses and partnerships for a more sustainable future. We develop industries that matter to people and society. Since 1905, Hydro has turned natural resources into valuable products for people and businesses, creating a safe and secure workplace for our 31,000 employees in more than 140 locations and 40 countries. Today, we own and operate various businesses and have investments with a base in sustainable industries. Hydro is through its businesses present in a broad range of market segments for aluminium, energy, metal recycling, renewables and batteries, offering a unique wealth of knowledge and competence. Hydro is committed to leading the way towards a more sustainable future, creating more viable societies by developing natural resources into products and solutions in innovative and efficient ways.

OCP Group

ocpgroup.ma

Headquartered in Morocco, OCP Group is one of the world’s largest custodian and supplier of phosphate-based plant nutrition solutions and associated products for soil health and a leader in applied science and education. Our mission is to provide customized plant nutrition solutions for healthy food production. As an African business, we are committed to accelerating Africa’s development and south-to-south cooperation and making agriculture and food systems globally sustainable and resilient. We put farmers at the center of everything we do. Join us to help ensure a more sustainable and food secure future for all.

Maaden

maaden.com

Maaden is Saudi Arabia’s engine of industrial transformation and one of the world’s top ten mining giants by market cap and fastest growing globally. We’re building the future of mining, creating fully integrated value chains across gold, phosphate, bauxite, copper and beyond. Maaden’s new era of growth is at pace and scale unlike anything the industry has ever seen. We’re doubling gold production by 2030, investing SAR 420 billion ($112 billion) through 2040 and scaling world-class projects that will redefine what’s possible for Saudi mining. This isn’t evolution; it’s transformation at speed, at scale and with purpose. Since going public in 2008, Maaden has invested over SAR 120 billion ($32 billion) to build large-scale, long-life, cost-competitive operations that deliver both world-class products and strong returns. We help power Saudi Vision 2030 by making mining a key pillar of a diversified and sustainable economy beyond oil. We’re creating new industries, new jobs and new opportunities. With a team of over 8,000 people, Maaden is writing the next chapter of industrial progress in Saudi Arabia. Join us as we shape the future of mining and unearth tomorrow, together.

Glencore

cb glencore.com

Glencore is one of the world’s largest global diversified natural resource companies and a major producer and marketer of more than 60 commodities that advance everyday life. Through a network of assets, customers and suppliers that spans the globe, we produce, process, recycle, source, market and distribute the commodities that support decarbonisation while meeting the energy needs of today.

Loading…

NEWS

Tata Steel CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

March 12, 2026 11:00 AM

Cybersecurity's missing half: Why women still struggle to reach the top

Cybersecurity is attracting more women than ever, yet leadership remains largely male. What's causing the mid-career drop-off and how can...

Read Article

February 25, 2026 08:00 AM

Multibagger IPO: NSE SME-listed cybersecurity stock doubles allottees' money in five months

TechD Cybersecurity doubled investors' funds in five months post-IPO, but shares fell over 12% amid AI replacement concerns.

Read Article

February 13, 2026 08:00 AM

BSF Sub-Inspector Duped of Lakhs by Fraudsters Posing as Tata Steel Executives

BSF sub-inspector duped of ₹3.12L by fake Tata Steel execs using proforma invoice. RTGS+UPI payments extracted; Moradabad police probe bank...

Read Article

February 10, 2026 12:35 PM

EY at India AI Impact Summit 2026

Join EY at the India Impact AI Expo 2026 to explore how our innovative AI solutions can accelerate human-centered AI transformation at scale.

Read Article

January 29, 2026 08:00 AM

AI, GCCs are pushing India’s IT sector into a new phase: Economic Survey

The Survey notes that demand is shifting toward technologies such as generative AI, data engineering and cybersecurity.

Read Article

January 05, 2026 08:00 AM

Tata Steel, Ambuja Cements among top stock picks from SMC Global for strong returns

SMC Global said that CESC has been trading within a downward-sloping channel for a considerable period, indicating a phase of healthy...

Read Article

December 24, 2025 08:00 AM

Top stocks in news: Tata Steel, GAIL, HCL Tech, Adani Ports, Zydus Life, Coal India, Ola

Stocks including Tata Steel, GAIL, HCL Tech, Adani Ports, Zydus Life, Coal India, Ola Electric, Emcure Pharma, RVNL and more will be in the...

Read Article

December 18, 2025 01:30 PM

How Tata Steel became a leader in risk management in the steel sector

Discover how Tata Steel built industry-leading risk management with SAP BIS and EY, using real-time alerts to prevent fraud, improve compliance and protect...

Read Article

December 15, 2025 08:00 AM

ServiceNow in advanced talks to acquire cybersecurity startup Armis for upto $7 billion, says report

ServiceNow is in advanced talks to buy Israeli military veteran-run Armis for up to $7 billion, its largest acquisition.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…