Is there a patch available for CVE-2026-11859?

Yes, a patch is available for CVE-2026-11859. Update the affected software to the latest version immediately.

Canarytokens CVE-2026-11859

Q: What is the CVSS score of CVE-2026-11859?

CVE-2026-11859 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green. EPSS exploitation probability: 0.0%.

EUVD-2026-36001 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-10 0f2be0ad-3469-4e56-b38f-4eb96719b425

Docker XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 13:01 EUVD

Analysis Generated

Jun 10, 2026 - 12:31 vuln.today

DescriptionNVD

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.

This issue affects Canarytokens: from Docker tag sha-c0f3cf142 before sha-08c3f93d, from Git commit c0f3cf142 before 08c3f93d.

AnalysisAI

HTML injection in the 'fetch links' alert email feature of Thinkst Canarytokens allows unauthenticated remote attackers to embed malicious HTML and JavaScript into notification emails delivered to token owners (defenders). The vulnerability is notable because it weaponizes the deception platform's own alert mechanism against the security operators relying on it - turning a defensive tool into a phishing vector. Proof-of-concept exploit code exists (CVSS 4.0 E:P), though the vulnerability is not listed in CISA KEV and the CVSS 4.0 base score of 2.0 reflects the limited, interaction-dependent impact.

Technical ContextAI

Canarytokens is an open-source honeypot and deception technology platform by Thinkst Applied Research, typically deployed via Docker. The 'fetch link' token type triggers an HTML-formatted email notification to the token owner when the token URL is accessed. The root cause maps to CWE-74 (Injection): attacker-controlled input from the triggering HTTP request (such as headers, referrer, or URL parameters) is insufficiently sanitized before being embedded into the outbound HTML email. Email clients that render HTML - including Outlook, Gmail (HTML mode), and Apple Mail - are the downstream attack surface. The affected software spans Docker tag sha-c0f3cf142 through (but not including) sha-08c3f93d, and the corresponding Git commit range c0f3cf142 to 08c3f93d. No CPE string was provided in the available data.

RemediationAI

Upstream fix available (Git commit 08c3f93d); a released patched Docker tag is sha-08c3f93d - update self-hosted deployments to Docker tag sha-08c3f93d or any later tag and redeploy the container. The vendor's GitHub Security Advisory GHSA-55jf-cqr9-r7p4 (https://github.com/thinkst/canarytokens/security/advisories/GHSA-55jf-cqr9-r7p4) is the authoritative reference. For operators unable to update immediately, configuring recipient email clients to display messages as plain text (disabling HTML rendering) eliminates the XSS execution path entirely, though this affects HTML formatting across all emails and may reduce usability. CVSS remediation effort is rated Low (RE:L), indicating patching is straightforward.