CVE-2026-108753: Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Self-hosted Agnaistic agnai deployments using the affected self-host Docker Compose configuration are exposed. The issue affects versions through 1.0.555.
What does an attacker need to exploit it?
An attacker does not need authentication, privileges, or user interaction. They can use the fixed administrator password or create a JWT containing admin: true using the public JWT secret.
What access can successful exploitation provide?
An attacker can impersonate users, log in as an administrator, reset passwords, and modify server configuration. This can result in high confidentiality and integrity impact, with limited availability impact.