CVE-2026-86544: knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.30.0 - Compensating control
Ensure code.replace (mutating code action) is protected by proper authorization controls so read-restricted sessions cannot modify permission configurations and escalate privileges on subsequent calls.
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Deployments running knowns versions before 0.30.0 should be prioritized, particularly where users can obtain read-restricted sessions and invoke code actions.
What access does an attacker need to exploit this issue?
An attacker needs a read-restricted session. They can use code.replace to alter permission configurations, then escalate privileges on subsequent calls.