Description
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-110616 ↗
- github.com/nullclaw/nullhub ↗
- github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile ↗
- github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig ↗
- github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig ↗
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg ↗
- www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.