Which versions of Spikster are affected by CVE-2026-67594?

Spikster (all versions through commit e1cdf8c) is exposed to unauthenticated remote API access affecting approximately 50 backend endpoints, allowing attackers to provision and manage servers, reset…

How to fix or mitigate CVE-2026-67594?

Within 24 hours: Inventory all Spikster deployments and assess their network accessibility; immediately restrict API endpoint access via firewall rules or network segmentation to block external and untrusted internal traffic. Within 7 days: Deploy a Web Application Firewall or API gateway to enforce authentication before routing requests to Spikster; perform forensic log review of all API access since deployment for signs of unauthorized exploitation. Within 30 days: Monitor Spikster repository and vendor advisories for patch availability; develop and test an upgrade plan for affected instances; execute upgrade to patched version once vendor release is confirmed and validated.

Spikster CVE-2026-67594

Q: What is the CVSS score of CVE-2026-67594?

CVE-2026-67594 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-51276 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-30 VulnCheck

GHSA-rg37-h5w6-fj69

Authentication Bypass Spikster

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated remote API access (AV:N/PR:N/UI:N) with low complexity, and host file read/write plus root reset yields full C/I/A impact; scope unchanged as impact stays within the managed host system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:50 vuln.today

CVE Published

Jul 30, 2026 - 19:14 cve.org

CRITICAL 9.3

DescriptionCVE.org

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users.

AnalysisAI

Unauthenticated API access in Spikster (all versions through commit e1cdf8c) lets remote attackers reach roughly 50 backend endpoints because the CipiAuth middleware is registered but never bound to any route group, leaving the entire API open. Attackers can provision and enumerate servers, reset root passwords, read and write arbitrary files on the host, and create database users without any credentials. No public exploit identified at time of analysis, though a public GitHub issue and a VulnCheck advisory document the flaw in detail.

Technical ContextAI

Spikster is a self-hosted server/hosting management panel (a Cipi-derived control plane) that orchestrates provisioning, filesystem, and database operations on managed hosts via a REST API. The root cause is CWE-306 (Missing Authentication for a Critical Function): the CipiAuth authentication middleware exists and is declared in the application's service/route registration, but it is never attached to the API route group, so requests bypass the auth layer entirely. This is a classic framework middleware-binding mistake (common in Laravel-style route groups where middleware must be explicitly applied to a group), meaning authorization checks that developers assumed were global are effectively dead code. The single CPE identifies the affected product as cpe:2.3:a:yolanmees:spikster:*:*:*:*:*:*:*:* across all versions.

RemediationAI

No vendor-released patch version is identified at time of analysis; the fix is architectural, so the primary remediation is to apply the CipiAuth middleware to the API route group so every API route enforces authentication, then redeploy from a corrected commit (track the GitHub issue at https://github.com/yolanmees/Spikster/issues/24 and the VulnCheck advisory at https://www.vulncheck.com/advisories/spikster-missing-authentication-via-api-route-group for an official fixed release). Until a fixed build is confirmed, place the API behind a reverse proxy or firewall that requires authentication (e.g., restrict the API port to a management VPN or trusted admin IPs), which prevents anonymous internet access at the cost of blocking legitimate remote integrations, and take the panel offline from public networks if it is not actively managed. Verify manually that requests to the ~50 API endpoints without credentials are rejected after any change, since the flaw is precisely that the intended middleware was silently inactive.