CVE-2026-110616: falha crítica em nullclaw NullHub
NullHub through 2026.5.29 Missing Authentication for /api Management API
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.2epss 1.0%
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
nullclaw · NullHubReferências
https://github.com/nullclaw/nullhubhttps://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile#L69-L71https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig#L29-L54https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig#L546-L556https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izghttps://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api