CVE-2026-85978: Unauthenticated Remote Code Execution in Akana API Platform
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of Akana API Platform with the Policy Manager console reachable by an attacker are exposed. The issue is in the console's handling of crafted requests before authentication is enforced.
What does an attacker need to exploit it?
The attacker needs only network access to send a crafted request to the Policy Manager console. No credentials or user interaction are required.
What is the consequence of successful exploitation?
A crafted request can bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing. This can result in arbitrary code execution on the affected system.