CVE-2026-86543

Published: Sep 7, 2026Modified: Sep 7, 2026

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (7)

https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go#L193-L200

Source: disclosure@vulncheck.com

https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go#L80-L86

Source: disclosure@vulncheck.com

https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/tunnel.go#L26-L38

Source: disclosure@vulncheck.com

https://github.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fb

Source: disclosure@vulncheck.com

https://github.com/knowns-dev/knowns/releases/tag/v0.30.0

Source: disclosure@vulncheck.com

https://github.com/knowns-dev/knowns/security/advisories/GHSA-fc85-99vc-9c75

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/knowns-before-0.30.0-unauthenticated-management-api-exposure

Source: disclosure@vulncheck.com

Timeline

No history available yet.