by Kastro
Paper/Archive/CVE-2026-86543

CVE-2026-86543

knowns-dev knowns — knowns before 0.30.0 Unauthenticated Management API Exposure

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 58.4.584 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

Affected

ProductAffectedFixed inSource
knowns< 0.30.00.30.0CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/knowns-dev/knowns/security/advisories/GHSA-fc85-99vc-9c75writeupgithub.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go#L80-L86writeupgithub.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go#L193-L200writeupgithub.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/tunnel.go#L26-L38patchgithub.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fbrefgithub.com/knowns-dev/knowns/releases/tag/v0.30.0writeupvulncheck.com/advisories/knowns-before-0.30.0-unauthenticated-management-api-exposure