CVE-2026-86543
criticalknowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installa…
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-07 23:16
Modified: 2026-09-14 20:17
NVD status: Deferred
Last synced 1 day ago
Verified against the source API 2026-10-27 06:51 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go#L193-L200 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go#L80-L86 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/tunnel.go#L26-L38 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fb disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/releases/tag/v0.30.0 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-fc85-99vc-9c75 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/knowns-before-0.30.0-unauthenticated-management-api-e... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:51 UTC · record ↗