Unauthenticated superuser registration and RCE in UpSnap (CVE-2026-49819)

UpSnap's `POST /api/upsnap/init-superuser` endpoint (`backend/pb/handlers.go:249`) lacks authentication, a setup token, an IP allow-list, and rate limiting. On any fresh installation, an unauthenticated network-adjacent attacker can register the initial superuser account and obtain a long-lived JWT. That JWT grants access to a shell-injection sink at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`), enabling root remote code execution on the host. Affected versions: - >= 4.4.1, <= 5.3.5 We recommend updating to: >= 5.4.0. CVSS 9.8 · our assessment: act_now Reference: https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-w4jr-728f-5jhq Details: https://vuln.today/cve/CVE-2026-49819