MiroFish CVE-2026-7042

Remote unauthenticated exploitation against default REST API configurations. The vulnerability triggers when the create_app function in backend/app/__init__.py initializes the Flask application without properly configuring authentication middleware or endpoint decorators. No special configuration, user interaction, or authentication is required (CVSS PR:N/UI:N). Exploitation requires only network connectivity to the REST API endpoints (typically HTTP/HTTPS on standard ports). Limiting factors: exploitation impact is constrained to Low across C/I/A per CVSS vector, suggesting authentication bypass provides partial rather than complete unauthorized access - likely restricted to specific API operations or data subsets rather than full administrative control. The Scope:Unchanged (S:U) indicates the vulnerability does not enable lateral movement to other components.

Real-world risk is HIGH despite moderate CVSS impacts (C:L/I:L/A:L). The CVSS vector confirms this is a network-accessible, low-complexity attack requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by remote unauthenticated attackers. The Proof-of-Concept exploit published at GitHub issue #487 lowers the barrier to exploitation significantly. While individual impacts are rated Low rather than High, the combination of confidentiality, integrity, and availability impacts means attackers gain partial unauthorized access across all three security domains. The vendor's non-responsiveness to the vulnerability report (RL:X - remediation level unavailable) is a critical risk multiplier, as no official patch timeline exists. Organizations using MiroFish 0.1.2 or earlier with REST API exposed to the internet face immediate exploitation risk. The lack of EPSS data and KEV listing suggests this is not yet widely exploited in the wild, but the public POC makes automated scanning and exploitation likely in the near term. Priority should be CRITICAL for internet-facing deployments, MEDIUM for internal-only deployments with network segmentation.

A remote attacker scans the internet for MiroFish installations using Shodan or similar tools, identifying exposed REST API endpoints. Using the publicly available exploit from GitHub issue #487, the attacker sends crafted HTTP requests directly to protected API endpoints without authentication credentials. The vulnerable create_app function processes these requests, bypassing intended authentication checks and allowing the attacker to read sensitive data, modify application state, or disrupt service availability depending on the specific API endpoints exposed.