CVE-2026-67594

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/yolanmees/Spikster/issues/24
https://www.vulncheck.com/advisories/spikster-missing-authentication-via-api-route-group

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Spikster a través del commit e1cdf8c contiene una vulnerabilidad de autenticación faltante que permite a atacantes remotos no autenticados acceder a todas las rutas de la API explotando el middleware CipiAuth no adjunto, que está registrado pero nunca se aplica a ninguna ruta en la configuración de enrutamiento de la API. Los atacantes pueden invocar aproximadamente 50 endpoints de la API no protegidos para enumerar y aprovisionar servidores, restablecer contraseñas de root, leer y escribir archivos arbitrarios en el host, y crear usuarios de base de datos.

Information

Published : 2026-07-30 20:18

Updated : 2026-10-23 22:10

NVD link : CVE-2026-67594

Mitre link : CVE-2026-67594

CVE.ORG link : CVE-2026-67594

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-67594", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67594", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T15:45:33.095434Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/yolanmees/Spikster", "vendor": "yolanmees", "product": "Spikster", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "e1cdf8c4b780c87457b548c38a87982b549e2465"}], "packageURL": "pkg:github/yolanmees/Spikster", "defaultStatus": "affected"}]}], "published": "2026-07-30T20:18:15.173", "references": [{"url": "https://github.com/yolanmees/Spikster/issues/24", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/spikster-missing-authentication-via-api-route-group", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users."}, {"lang": "es", "value": "Spikster a trav\u00e9s del commit e1cdf8c contiene una vulnerabilidad de autenticaci\u00f3n faltante que permite a atacantes remotos no autenticados acceder a todas las rutas de la API explotando el middleware CipiAuth no adjunto, que est\u00e1 registrado pero nunca se aplica a ninguna ruta en la configuraci\u00f3n de enrutamiento de la API. Los atacantes pueden invocar aproximadamente 50 endpoints de la API no protegidos para enumerar y aprovisionar servidores, restablecer contrase\u00f1as de root, leer y escribir archivos arbitrarios en el host, y crear usuarios de base de datos."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "disclosure@vulncheck.com"}