CVE-2026-110616CWE-306

CVE-2026-110616

High · published October 14, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00807 · 56.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-14T19:17Z
References (7)
https://github.com/nullclaw/nullhub · [email protected]https://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile#L69-L71 · [email protected]https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig#L29-L54 · [email protected]https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig#L546-L556 · [email protected]https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg · [email protected]https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api · [email protected]https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 14 OCT 14:16Z
    NullHub through 2026.5.29 Missing Authentication for /api Management API
    cvelistv5
  • 14 OCT 14:16Z
    NullHub through 2026.5.29 Missing Authentication for /api Management API
    cvelistv5