EUVD-2026-40168
GHSA-9f32-pf5h-p947
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Hasura API with only a low-privilege operator/spectator login (PR:L, AC:L); pure cross-operation data read gives C:H with no integrity or availability impact and unchanged scope.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload_build_step to read step_stdout, step_stderr, step_name, and step_description across all operations on the server.
AnalysisAI
Cross-operation information disclosure in Mythic C2 framework versions before 3.4.0.60 allows any authenticated operator or spectator to read payload build artifacts belonging to operations they are not assigned to. A broken Hasura GraphQL permission filter on the payload_build_step table contains an always-true _or clause, neutralizing the operation-scoped row-level access control and exposing step_stdout, step_stderr, step_name, and step_description across every operation on the server. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is publicly committed and the conditions are trivial for any logged-in low-privilege user.
Technical ContextAI
Mythic is an open-source, multi-operator command-and-control (C2) framework used in red-team engagements; it relies on a Hasura GraphQL engine layered over PostgreSQL to enforce per-operation tenant isolation through declarative row-level permission filters. Access to sensitive tables is supposed to be scoped so an operator only sees data for operations they belong to. This vulnerability is a classic CWE-863 (Incorrect Authorization): the select permission on the payload_build_step table was defined with an _or boolean condition where one branch is always satisfied, so the intended operation-membership predicate is short-circuited and every row is returned regardless of the requesting user's operation. Because payload build steps capture compiler/agent build output (stdout, stderr, step names and descriptions), the leaked data can reveal payload configuration, infrastructure naming, and operational tradecraft of unrelated teams sharing the server.
RemediationAI
Vendor-released patch: upgrade Mythic to version 3.4.0.60 or later, which corrects the Hasura select permission on payload_build_step (release notes at https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60, fix commit 82648e8241b800a32e1882afc310e7316d98ebaa, advisory at https://www.vulncheck.com/advisories/mythic-broken-permission-filter-in-payload-build-step-table). If you cannot upgrade immediately, the most effective compensating control is to stop using a single shared Mythic instance for separate engagements - segregate operations onto dedicated servers so cross-operation reads have no untrusted data to expose, at the cost of additional infrastructure. As an interim measure on a self-hosted instance you can manually correct the Hasura metadata for the payload_build_step table by removing the always-true _or branch and enforcing the operation-membership filter, then reload metadata; this requires Hasura admin access and should be validated against the official patch to avoid drift. Additionally, restrict and audit operator/spectator account provisioning so only trusted personnel hold accounts on multi-team servers, recognizing this only narrows the insider population rather than closing the flaw.
Cross-operation authorization bypass in Mythic C2 framework before 3.4.0.60 exposes encryption keys and C2 profile confi
Authorization bypass in Mythic C2 framework before 3.4.0.60 allows authenticated spectator-role users to perform write o
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today