Is there a public PoC exploit available for CVE-2026-58446?

Yes, a public proof-of-concept exploit is available for CVE-2026-58446. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-58446?

Yes, a patch is available for CVE-2026-58446. Update the affected software to the latest version immediately.

Presenton CVE-2026-58446

Q: What is the CVSS score of CVE-2026-58446?

CVE-2026-58446 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40414 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-06-30 VulnCheck

GHSA-j446-h28c-8p3v

Authentication Bypass Nginx Docker Presenton

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible with no prerequisites; C:N as no existing data is read; I:L for unauthorized content creation; A:L for LLM API quota exhaustion without full denial of service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 30, 2026 - 22:22 NVD

6.5 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Jun 30, 2026 - 22:01 vuln.today

CVE Published

Jun 30, 2026 - 21:05 cve.org

MEDIUM 6.5

DescriptionCVE.org

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).

AnalysisAI

Authentication bypass in Presenton's bundled MCP server exposes server and Docker deployments to unauthenticated remote exploitation via the unprotected /mcp endpoint. When operators configure session authentication using AUTH_USERNAME/AUTH_PASSWORD, nginx enforces access control on all paths except /mcp, which is absent from the auth_request gate - and the MCP server compounds this by auto-minting valid internal session tokens for the configured user on any incoming request. An unauthenticated remote attacker can therefore invoke MCP tools such as generate_presentation as if fully authenticated, consuming the operator's LLM API keys and writing arbitrary presentations to the instance. A publicly available proof-of-concept exists; no active exploitation confirmed in CISA KEV.

Technical ContextAI

Presenton (CPE: cpe:2.3:a:presenton:presenton:*:*:*:*:*:*:*:*) is an AI-powered presentation tool that, in its server and Docker deployment modes, embeds an MCP (Model Context Protocol) server to expose AI tools over HTTP. The Docker stack places nginx in front as a reverse proxy that enforces session authentication via the auth_request directive, but the /mcp location block was not included in that gate, leaving it publicly accessible. Compounding the misconfiguration, the MCP server itself auto-mints a valid internal session token bound to the configured AUTH_USERNAME/AUTH_PASSWORD credentials for any caller - meaning the bypass not only reaches the endpoint unauthenticated but also receives a legitimately signed token, making all downstream tool invocations indistinguishable from operator actions. CWE-306 (Missing Authentication for Critical Function) applies precisely: the MCP tool-invocation function is critical (it consumes external LLM API quotas and writes application data) but was shipped without its own authentication layer, relying entirely on a proxy-level gate that was not correctly configured. The Electron desktop build ships with MCP disabled and is not affected.

RemediationAI

Upgrade Presenton to version 0.8.8-beta or later, which adds the nginx auth_request gate to the /mcp location block (fix commit a1103dcef3c761cc8bab44e2862c81a49969abd7; see PR https://github.com/presenton/presenton/pull/679 and release https://github.com/presenton/presenton/releases/tag/electron-v0.8.8-beta). As an immediate compensating control prior to patching, operators should add the auth_request directive to the nginx /mcp location block in their custom nginx configuration to enforce the same session-authentication check applied to other paths - note that any MCP clients relying on unauthenticated access will break and must be updated to supply credentials. Alternatively, firewall or network-layer rules can restrict access to the /mcp path to trusted source IP ranges only; this reduces exposure without requiring nginx changes but may disrupt legitimate MCP integrations. Rotating any LLM API keys associated with the deployment is advisable if the endpoint was internet-accessible prior to patching, given the PoC's public availability.