cc-connect CVE-2026-108549

Exploitable only when the MAX platform adapter is deployed in webhook mode AND no webhook_secret is configured, with the webhook listener on port 8080 reachable by the attacker; the attacker must also supply a valid allowed or admin user_id to invoke privileged commands like /shell. Limiting factors: configuring a webhook_secret closes the hole entirely, the listener must be network-reachable (not firewalled/bound to localhost), and knowledge of a permitted user_id is required - reflected by the CVSS 4.0 AC:H and AT:P metrics. This is a non-default-hardening/misconfiguration-dependent path rather than exploitation of a hardened default.

This is a genuinely high-priority flaw where exploitable, but its real-world reach is narrowed by configuration preconditions. The provided CVSS 4.0 vector (AV:N/PR:N/UI:N) confirms a network-reachable, unauthenticated attack path with full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - consistent with CWE-306 (Missing Authentication) leading to arbitrary command execution via /shell on the host. However, two metrics temper the raw 9.2 score: AC:H and AT:P indicate the attack is not trivially universal - it depends on a specific deployment state (no webhook_secret configured) and on the attacker supplying a valid allowed/admin user_id. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or widespread automation; exploitation status is best characterized as theoretical at analysis time. The dominant risk driver is therefore impact severity plus unauthenticated network exposure, offset by the fact that it only applies to misconfigured/default-secretless instances of a low-footprint open-source tool. Net: treat as critical-to-patch for any operator running the MAX adapter in webhook mode, but it is not a mass-exploitation Internet emergency on the evidence provided.

An operator runs cc-connect's MAX platform adapter in webhook mode on port 8080 without setting webhook_secret. A remote attacker who can reach that listener crafts a forged MAX update containing an allowed or admin user_id and issues a privileged command such as /shell, achieving command execution on the host. No public exploit code is identified at time of analysis, and the AC:H/AT:P metrics mean the attacker needs the secret to be unset and must supply a valid privileged user_id.