EUVD-2026-83182
GHSA-w72w-9qmj-c9qm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H for the required MITM/DNS-hijack interception; C:L (not C:H) because source shows only a one-way SHA256 digest leaving the process, so direct secret disclosure is unestablished; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory's claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15.
AnalysisAI
AnyCable (anycable-go) through 1.6.14 ships its telemetry subsystem enabled by default with a hardcoded public auth token ('secret' in telemetry/config.go) and derives its cluster fingerprint by hashing the full configuration file plus raw os.Args, which can include values passed via --secret, --jwt_secret, and --http_rpc_secret; an adversary who can MITM or DNS-hijack telemetry.anycable.io can intercept the outbound telemetry POST, and because the client's token is publicly known it offers no protection. The transmitted clusterFingerprint is a SHA256 digest rather than raw plaintext, so meaningful secret recovery additionally depends on low-entropy secrets, and the required network-interception position makes this a moderate-to-low real-world risk best characterized as a hardcoded-credential and telemetry-exposure design flaw rather than a directly exploitable credential leak. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) telemetry enabled, which was the DEFAULT in versions <=1.6.14 because a hardcoded authToken='secret' shipped in the public source; (2) the operator supplying secrets via config file or CLI flags (--secret, --jwt_secret, --http_rpc_secret) that feed clusterFingerprint; and (3) the attacker achieving a MITM position or DNS hijack of telemetry.anycable.io to intercept the outbound telemetry POST. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-to-low real-world risk best characterized as a hardcoded-credential and telemetry-exposure design flaw, not a directly exploitable credential leak. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to AnyCable 1.6.15, the vendor-released patch, which replaces the hardcoded authToken with an empty default (var auth = ""), requires an operator- or build-time token before telemetry is active, and gates telemetry announce, collection, and shutdown behind Tracker.Enabled() so tracking is off unless explicitly opted in; apply the upstream commit 201c67e99e463ed63bd6b345562f4c458385fcee or the tagged release v1.6.15 and review GHSA-w72w-9qmj-c9qm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's f
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today