EUVD-2026-104384
GHSA-mc9q-gx24-2r44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure developer to malicious page or reach exposed port
-
DeliveryCross-site/DNS-rebinding request to local unauthenticated API
-
ExploitBypass absent Host/Origin validation
-
ExecutionManipulate path argument to read files
-
ImpactExfiltrate disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a running octoally server at version ≤1.0.87; in that version the server defaults to binding '::' (all IPv4/IPv6 interfaces, per the pre-patch config.ts) and the API has NO authentication and NO Host/Origin validation. Exploitation path: directly over the network if the port is reachable, OR via a victim's browser through DNS rebinding / cross-site requests even on a loopback deployment, because the pre-patch code performed no Origin or Host-header checks. Limiting factors: the victim must have the server running; browser-based exploitation additionally requires the victim to visit an attacker-controlled page while the server is up; direct network exploitation requires network reachability to the configured port. The 1.0.88 fix binds to loopback only by default and rejects non-loopback Host and cross-origin requests. |
| Impact | CVSS 4.0 base score is 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and only VC:L impact, and the E:P in the vector plus the VulDB listing confirm proof-of-concept exploit maturity rather than active exploitation. This is NOT CISA KEV-listed and no EPSS score is provided in the input, so widespread opportunistic exploitation cannot be confirmed - the signal set points to a publicly disclosed but not mass-exploited flaw. A key conflict exists between sources: VulDB frames this as low-impact 'information disclosure' (VC:L, I/A none), but the vendor's own patch evidence states the unauthenticated API 'lets anyone who can reach the port read/write files and run commands,' and the pre-patch default bound to '::' (all interfaces) rather than loopback. The real risk is therefore likely higher than the VC:L score implies for any instance that is network-reachable or attacked via a browser (no Origin/Host validation existed, enabling DNS rebinding and cross-site WebSocket hijacking). Mitigating the priority: octoally is an obscure developer tool with a tiny deployment footprint, so even with a public PoC the real-world exposure is limited to the small population running it - making this a lower operational priority than the raw unauthenticated-RCE potential would suggest for a widely deployed product. |
| Exploit ScenarioDerived | A developer runs octoally ≤1.0.87, whose local server binds all interfaces by default and exposes an unauthenticated API with no Host/Origin checks. An attacker either reaches the port directly over the network or lures the developer to a malicious web page that issues cross-site/DNS-rebinding requests to the local API, manipulating the 'path' argument to disclose file contents. A public proof-of-concept is referenced in GitHub issue #24. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Information disclosure in OctoAlly (ai-genius-automations/octoally) through version 1.0.87 lets remote attackers manipulate the path argument handled in server/src/index.ts to expose data the server should not return. Per the CVSS vector (PR:N, AV:N) no authentication is required, and because pre-1.0.88 builds default to binding all interfaces with no Host or Origin validation, exposure is reachable either directly over the network or through a victim's browser via DNS rebinding or cross-origin requests against an otherwise loopback-only deployment. Publicly available exploit code exists (upstream issue #24) and the vendor shipped a fix in 1.0.88; no confirmed active exploitation (CISA KEV) has been reported, and the CVSS 4.0 base score is 6.9 with E:P reflecting proof-of-concept maturity rather than in-the-wild use.
RemediationAI
Upgrade to OctoAlly 1.0.88 or later (release tag v1.0.88; patch commit 3898085c4e701be21377ebd9e91e10b941e47168), which binds only to loopback by default and rejects non-loopback Host and cross-origin Origin headers on both HTTP and WebSocket upgrade paths. If immediate upgrade is not possible, the highest-value compensating control is to stop the pre-1.0.88 server from listening on routable interfaces by starting it with HOST=127.0.0.1 (or an equivalent loopback-only bind) and blocking the configured port at the host firewall and any container port mappings; the trade-off is that remote/container access to the UI and terminal features stops working, and because 1.0.87 performs no Origin or Host checking, browser-based DNS-rebinding and cross-site WebSocket hijacking against a loopback deployment remain possible whenever the user visits untrusted pages while the server is up. Fronting the service with a reverse proxy that enforces an exact Host/Origin allowlist and HTTP authentication adds a real pre-auth boundary but requires proxy configuration and breaks non-browser clients that cannot supply credentials. Additional hardening with no functional side effects beyond reduced feature scope: run the process as an unprivileged user with no access to sensitive directories, avoid opening untrusted sites in the same browser profile while the server runs, and delete or relocate any secrets and files in the process working directory, since path-manipulation disclosure reads from the server's context. Note that 1.0.88's security model is network isolation, not authentication, so do not assume an API token exists to enable; consult the vendor advisory and release notes at https://github.com/ai-genius-automations/octoally/releases/tag/v1.0.88 and https://vuldb.com/vuln/422254 for confirmation of the fixed build before closing the finding.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OctoAlly is a Node.js/TypeScript developer tool whose backend is a Fastify HTTP server exposing a tRPC router plus WebSocket terminals (server/src/index.ts, server/src/config.ts). The root cause class is CWE-200 (Exposure of Sensitive Information), specifically an API that performs no authentication and no request-origin validation: the pre-patch config used host: process.env.HOST || '::' (dual-stack bind to all IPv4/IPv6 interfaces), the optional OCTOALLY_TOKEN auth token was effectively unused/removed, and there was no Host-header or Origin-header check on either HTTP requests or WebSocket upgrades. That combination turns a local-first tool into a network-reachable, unauthenticated service and also defeats the implicit loopback trust boundary, since a malicious web page can use DNS rebinding (attacker-controlled hostname re-resolving to 127.0.0.1) or plain cross-site requests/WebSocket hijacking to reach the local port. The 1.0.88 patch (commit 3898085c4e701be21377ebd9e91e10b941e47168) addresses the root cause rather than only the symptom: it defaults HOST to 'localhost', binds 127.0.0.1 and ::1 explicitly, adds an onRequest hook that returns 403 for non-loopback Host headers and non-loopback/cross-site Origin headers (while allowing origin-less requests such as curl and server-to-server hooks), and emits a runtime warning when HOST is overridden to a non-loopback address. The CPE cpe:2.3:a:ai-genius-automations:octoally:*:*:*:*:*:*:*:* is a wildcard covering the product line; only releases up to and including 1.0.87 carry the vulnerable configuration.
Know when Octoally gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Unauthenticated API bound to all interfaces by default with no Origin/Host checks, so AV:N/AC:L/PR:N/UI:N; CVE scoped to file disclosure, hence C:L and I:N/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB