cc-connect CVE-2026-76761

The Management API must be network-accessible - exploitation is possible remotely with no authentication required per the CVSS 4.0 PR:N rating. No special configuration, feature toggle, or non-default deployment mode is required beyond the Management API being reachable. The vulnerable code path is in shellExecCommand within core/engine.go, triggered by supplying a crafted exec argument. Limiting factors: cc-connect must be deployed and the Management API port must not be firewalled; the software is a niche project with low overall deployment count, which limits the realistic target population. No user interaction is required on the victim side.

The risk signals present a notable conflict worth flagging. The supplied CVSS 4.0 score is 5.5 with VC:L/VI:L/VA:L, which substantially underrates the realistic impact of an unauthenticated OS command injection - arbitrary command execution on the host system should correspond to high C/I/A impacts. This underrating appears to be the reporter's conservative assessment and should not be taken at face value. Real-world risk is meaningfully higher: the attack vector is network, complexity is low, no authentication or user interaction is required (PR:N, UI:N), and a public exploit exists (E:P). KEV status is not present, and EPSS data was not provided, but the combination of unauthenticated remote code execution with a public PoC represents a serious priority for any organization running this software. Limiting factor is prevalence - cc-connect appears to be a niche, low-adoption project with an inactive maintainer, which substantially caps actual exposure. The GitHub issue being auto-closed due to inactivity also indicates no vendor patch exists, leaving users with no remediation path beyond removal or isolation.

A remote unauthenticated attacker sends a crafted HTTP request to the cc-connect Management API endpoint, supplying a malicious value in the exec argument (e.g., appending shell metacharacters such as ; id or $(whoami)) that is passed without sanitization to shellExecCommand in core/engine.go. The injected OS command executes under the process privileges of the cc-connect service on the host. A public exploit exists, lowering the bar for exploitation to script-kiddie level.