CVE-2026-110616: NullHub through 2026.5.29 Missing Authentication for /api Management API
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated remote access?
Instances with a non-loopback listener are exposed when requests can reach the management API. The affected condition is requests to /api/* that omit both Authorization and Origin headers.
What can an unauthenticated attacker do after reaching the API?
An attacker can control agent instances, rewrite configuration settings including provider credentials, and manage cron jobs and MCP servers. The reported impact includes confidentiality, integrity, and availability consequences.
Is an existing credential required to exploit this issue?
No. The vulnerability results from auth_token defaulting to null and never being assigned, allowing unauthenticated access under the described request conditions.
What should be prioritized if an upgrade is not immediately possible?
Prevent untrusted network access to non-loopback listeners hosting the management API. Restrict access so attackers cannot send requests to /api/* from outside trusted local or administrative paths.