Security Advisory
CVE-2026-86543
CVSS 9.8
CRITICAL
Vulnerability Description
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Published Date
2026-09-07T23:16:54.160
Data Feed
NIST National Vulnerability Database