CVE-2026-103057: AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AiSOCto a version that resolves this vulnerability.Fixed in 12.0.0
Event History
Frequently Asked Questions
Which deployments are affected?
AiSOC versions 5.1.0 through versions before 12.0.0 are affected. Version 12.0.0 is identified as the release containing the fix.
What does an attacker need to exploit this issue?
An attacker can send POST requests to the realtime service internal endpoints /internal/agent-event or /internal/push without authentication. No privileges or user interaction are required, although network access to those endpoints is necessary.
What can a successful attacker do?
An attacker can submit arbitrary events using spoofed tenant identifiers, potentially broadcasting malicious content through WebSocket and Redis SSE channels. They can also send unauthorized notifications to registered devices.
What should be prioritized if immediate upgrading is not possible?
Restrict network access to the realtime service internal endpoints /internal/agent-event and /internal/push so untrusted attackers cannot reach them. The provided information does not describe another mitigation.