CVE-2026-86543
knowns before 0.30.0 Unauthenticated Management API Exposure
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 7, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 7, 2026
Description
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
knownsknowns-dev |
|
References
- GitHub Security Advisory (GHSA-fc85-99vc-9c75)vendor-advisory
- AuthManager.Middleware is a no-op when no password is configured (v0.29.1)technical-description
- Browser listener binds 0.0.0.0 (v0.29.1)technical-description
- POST /api/tunnel/start has no authorization check of its own (v0.29.1)technical-description
- knowns fix commit 878a02cb7cc1patch
- knowns v0.30.0 Release Notesrelease-notes
- VulnCheck Advisory: knowns before 0.30.0 Unauthenticated Management API Exposurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.