CVE-2026-103053: AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API
AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AiSOCto a version that resolves this vulnerability.Fixed in 12.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated use of the response-action API?
AiSOC versions from 9.0.0 before 12.0.0 are affected when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment.
What can an unauthenticated attacker do through the exposed endpoints?
An attacker can list response-action integrations, submit and approve actions as arbitrary principals, and dispatch containment actions using vendor credentials.
What conditions must an attacker meet to exploit this issue?
No authentication or user interaction is required. The attacker needs network access to the affected response-action API endpoints.
What is the available remediation?
Upgrade AiSOC to version 12.0.0 or later. The referenced v12.0.0 release and associated commit address the issue.