CVE-2026-108549: cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin userid to run privileged commands like /shell on the host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure a webhook_secret for the MAX platform adapter webhook listener so updates are authenticated.
MAX platform adapter webhook mode webhook_secret = configured with a non-empty secret
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the MAX platform adapter in webhook mode are exposed if no webhook_secret is configured and the webhook listener on port 8080 is reachable by a remote attacker. The affected versions are cc-connect through 1.5.0.
What does an attacker need to exploit it?
An attacker needs network access to the webhook listener on port 8080. They can send forged, unauthenticated updates using an allowed or admin user_id; no prior authentication is required.
What could successful exploitation allow?
A successful attacker can impersonate an allowed or administrative MAX user and invoke privileged commands. The reported impact includes running commands such as /shell on the host.
What can be done if updating is not immediately possible?
Configure a webhook_secret for the MAX webhook mode and restrict remote access to the listener on port 8080. This prevents the described unauthenticated webhook acceptance and reduces exposure to untrusted network clients.