CVE-2026-22096CWE-306

Missing authentication for webserver endpoints

Critical · published July 13, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
45.0
In the wild
Unconfirmed
What it is

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00546 · 45.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-13T09:10Z
EPSS history
Timeline
  • 13 JUL 09:10Z
    Missing authentication for webserver endpoints
    cvelistv5