SmythOS sre CVE-2026-7022

Q: What is the CVSS score of CVE-2026-7022?

CVE-2026-7022 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25697 MEDIUM

Improper Authentication (CWE-287)

2026-04-26 cna@vuldb.com

Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 06:22 euvd

EUVD-2026-25697

Analysis Generated

Apr 26, 2026 - 06:22 vuln.today

CVE Published

Apr 26, 2026 - 06:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in SmythOS sre up to 0.0.15. Affected is the function AgentRuntime of the file packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts of the component HTTP Header Handler. Such manipulation of the argument X-DEBUG-RUN/X-DEBUG-INJ leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authentication in SmythOS sre up to version 0.0.15 allows remote attackers to bypass authentication via manipulation of HTTP headers X-DEBUG-RUN and X-DEBUG-INJ in the AgentRuntime component, enabling unauthorized access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vendor has not responded to early disclosure notification.

Technical ContextAI

The vulnerability exists in the HTTP Header Handler functionality of the AgentRuntime class within packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts. The root cause is classified as CWE-287 (Improper Authentication), indicating that the application does not properly validate or enforce authentication mechanisms when processing debug-related HTTP headers. The X-DEBUG-RUN and X-DEBUG-INJ headers appear to be intended for debug functionality but lack proper access controls, allowing an attacker to manipulate these headers to circumvent authentication checks without requiring prior credentials or elevated privileges.

RemediationAI

Upgrade SmythOS sre to a version newer than 0.0.15 if a patched release is available from the vendor. If no patched version is currently released, immediately disable or restrict network access to any SmythOS sre deployment until a fix is available, as the authentication bypass is trivially exploitable via HTTP headers. As a temporary compensating control, implement a Web Application Firewall (WAF) or reverse proxy that strips or validates the X-DEBUG-RUN and X-DEBUG-INJ HTTP headers before they reach the application - reject or sanitize any requests containing these headers from untrusted sources. Additionally, restrict network access to the AgentRuntime endpoint to trusted IP addresses or internal networks only. Note that vendor non-responsiveness means patches may not be forthcoming; organizations should monitor vendor communication channels and consider alternative solutions if a timely patch is not released.