Canarytokens CVE-2026-13140

Q: What is the CVSS score of CVE-2026-13140?

CVE-2026-13140 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38736 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 ThinkstAppliedResearch

XSS Docker Canarytokens Thinkst Applied Research

1.1

CVSS 4.0 · Vendor: ThinkstAppliedResearch

Severity by source

Vendor (ThinkstAppliedResearch) PRIMARY

1.1 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Requires low-privilege auth (PR:L), knowledge of a random identifier (AC:H), and victim page visit (UI:R); stored XSS crosses into victim browser scope (S:C) with limited confidentiality and integrity impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ThinkstAppliedResearch).

CVSS VectorVendor: ThinkstAppliedResearch

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 12:16 vuln.today

DescriptionCVE.org

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens.

Anonymous exploitation requires knowledge of a random identifier.

This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

AnalysisAI

Stored XSS in the AWS API key store component of Thinkst Applied Research Canarytokens allows a low-privileged attacker who knows a token's random identifier to inject persistent malicious scripts that execute in a victim's browser when they view the affected token page. Exploitation is constrained by high attack complexity (AC:H), a prerequisite attack requirement (knowledge of a random identifier), low-privilege authentication, and active user interaction - reflected in an extremely low CVSS 4.0 base score of 1.1. No active exploitation is confirmed; however, the CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists.

Technical ContextAI

Canarytokens is a deception/honeypot platform by Thinkst Applied Research that generates tracking tokens (including fake AWS API keys) to detect unauthorized access or credential use. The vulnerability resides in the web interface that exposes the AWS API key store - specifically, user-controlled input is persisted server-side without adequate sanitization and later rendered in the browser without proper output encoding, satisfying the classic CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) root cause for stored XSS. Affected deployments are identified via CPE cpe:2.3:a:thinkst_applied_research:canarytokens:*:*:*:*:*:*:*:* and are scoped to Docker images and Git commits between sha-4116b92cb (inclusive) and sha-f5aa5c4e (exclusive). The Docker-based deployment model means self-hosted instances are the affected population.

RemediationAI

Update the self-hosted Docker deployment to image tag sha-f5aa5c4e or any later commit in the Thinkst canarytokens repository - this is the confirmed upstream fix per the vendor security advisory at https://github.com/thinkst/canarytokens/security/advisories/GHSA-23pf-xjp2-48q6. No specific workaround version was provided beyond the fix commit. If immediate upgrade is not feasible, operators can reduce exposure by restricting access to the Canarytokens web management interface to trusted internal networks or VPN only, eliminating the network-reachable attack surface. Additionally, auditing and rotating any AWS API key tokens whose identifiers may have been exposed to untrusted parties limits the attacker's ability to satisfy the random-identifier prerequisite. The trade-off of access restriction is that legitimate remote administrators would also require VPN access.