CVE-2026-86543: knowns before 0.30.0 Unauthenticated Management API Exposure
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Fresh installations of knowns versions before 0.30.0 are exposed by default because the management API is served without authentication on all network interfaces and no password is required.
What does an attacker need to exploit this issue?
An attacker needs network access to the management API. No authentication, privileges, or user interaction are required.
What can an attacker do with the exposed API?
An attacker can call the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the management API at a publicly accessible address.
How can I determine whether my installation is affected?
Installations running a knowns version before 0.30.0 are affected if the management API is using the described default unauthenticated configuration. A fresh installation with no password configured meets that condition.