Which versions of MeshCentral are affected by CVE-2026-66420?

MeshCentral version 1.1.21 contains a session hijacking vulnerability that allows unauthenticated attackers to impersonate administrators and gain full remote control of every managed device.. A patch is available.

How to fix or mitigate CVE-2026-66420?

Within 24 hours, inventory all MeshCentral 1.1.21 instances and identify those using self-signed certificates, as only these configurations are vulnerable; document findings and initiate change control for patching. Within 7 days, deploy the vendor patch (PR #7882, commit f04c9f4) to all affected instances and verify proper WebSocket origin validation is enforced regardless of certificate type. Within 30 days, review authentication and WebSocket connection logs for exploitation attempts, conduct post-patch validation across all managed devices to ensure normal remote control operations, and update your asset inventory to reflect patched status.

MeshCentral CVE-2026-66420

Q: What is the CVSS score of CVE-2026-66420?

CVE-2026-66420 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51333 HIGH

Origin Validation Error (CWE-346)

2026-07-30 VulnCheck

GHSA-fcvp-v754-r7rh

Authentication Bypass Openclaw Dashboard Tugcantopaloglu

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Unauthenticated network attack (PR:N) but requires an admin victim to visit attacker content (UI:R) and a self-signed-cert deployment; session/sessionKey theft yields full C/I/A High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 30, 2026 - 22:51 vuln.today

Analysis Generated

Jul 30, 2026 - 22:51 vuln.today

CVE Published

Jul 30, 2026 - 21:52 cve.org

HIGH 8.6

DescriptionCVE.org

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

AnalysisAI

Cross-site WebSocket hijacking in MeshCentral 1.1.21 lets unauthenticated remote attackers steal the server sessionKey and forge session cookies for any user, including administrators, ultimately gaining full remote control of every device managed by the instance. The flaw stems from an origin-validation bypass that only manifests on deployments using self-signed certificates, and it requires an authenticated admin to be lured into visiting attacker-controlled content (CVSS 4.0 8.6, UI:A). A vendor fix exists (PR #7882 / commit f04c9f4); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MeshCentral is a self-hosted, web-based remote monitoring and management (RMM) platform that controls agents on managed endpoints over WebSocket channels. The root cause is CWE-346 (Origin Validation Error): the CheckWebServerOriginName() function in webserver.js contains an unconditional early return - the removed line 'if (obj.isTrustedCert(domain) = false) return true;' caused origin checking to be skipped entirely whenever the server did not present a trusted certificate (i.e., self-signed cert deployments), silently returning 'true' (origin allowed) for any Origin header. The fix replaces this with 'return (obj.getWebServerName(domain, req) originUrl.hostname)', enforcing a real hostname comparison. Because the bypass disabled cross-site WebSocket protection across all twelve WebSocket endpoints, a cross-origin page could open authenticated WebSocket sessions and issue action commands, including one that discloses the sessionKey used to HMAC-sign session cookies - enabling universal cookie forgery. Note the CPE and tags in the intelligence feed reference 'openclaw-dashboard' / 'Openclaw Dashboard', which appears to be a data-mapping error inconsistent with the MeshCentral description and references.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor patch from commit f04c9f4 via PR #7882 (https://github.com/Ylianst/MeshCentral/pull/7882) or upgrade to the first tagged MeshCentral release that incorporates it, then verify CheckWebServerOriginName() enforces getWebServerName() hostname matching. As an immediate compensating control before patching, replace the self-signed certificate with a trusted CA-issued (or internal-PKI) certificate, which forces the code onto the certificate-name matching path and eliminates the unconditional bypass - the trade-off is the operational overhead of certificate issuance/renewal. Additionally, restrict administrative access to the MeshCentral web interface to a VPN or trusted-network allowlist so that a lured admin's browser cannot reach a public origin-forgery attack surface, and instruct administrators to log out of MeshCentral sessions before browsing untrusted sites. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/meshcentral-cross-site-websocket-hijacking-via-origin-validation-bypass-on-self-signed-certificate-deployments) for full details.