CVE-2026-86543CWE-306

CVE-2026-86543

Critical · published September 8, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00856 · 58.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-08T03:16Z
References (7)
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go#L193-L200 · [email protected]https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go#L80-L86 · [email protected]https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/tunnel.go#L26-L38 · [email protected]https://github.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fb · [email protected]https://github.com/knowns-dev/knowns/releases/tag/v0.30.0 · [email protected]https://github.com/knowns-dev/knowns/security/advisories/GHSA-fc85-99vc-9c75 · [email protected]https://www.vulncheck.com/advisories/knowns-before-0.30.0-unauthenticated-management-api-exposure · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 0%
    epss
  • 07 SEP 23:03Z
    knowns before 0.30.0 Unauthenticated Management API Exposure
    cvelistv5