Agnaistic Agnai EUVD-2026-96918

Exploitation requires that the target Agnai instance (version through 1.0.555) was deployed using the shipped self-host.docker-compose.yml with its fixed admin password and public JWT secret left unchanged, and that the instance is network-reachable by the attacker. The determining condition is use of the default hard-coded JWT_SECRET/admin credentials from the compose file (referenced at self-host.docker-compose.yml lines 18-26 and consumed in srv/api/auth.ts lines 11-14). The principal limiting factor is configuration: operators who override the JWT secret and admin password, or who do not expose the instance publicly, are not exploitable. No user interaction or prior authentication is needed against a vulnerable default deployment (PR:N/UI:N).

Multiple signals converge on genuine high risk for self-hosted instances. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:L, score 9.3) indicates a remotely reachable, low-complexity flaw requiring no authentication (PR:N) or user interaction, with high confidentiality and integrity impact - consistent with the description of unauthenticated admin login and attacker-forged admin JWTs. CWE-798 (hard-coded credentials) is a deterministic, reliably exploitable class rather than a memory-corruption flaw dependent on heap state, which raises practical exploitability. No EPSS score, KEV listing, or explicit POC flag was provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be asserted. However, one reference is a public hackmd technical write-up describing the hard-coded admin JWT secret, which lowers the attacker effort barrier even though it is not formally flagged as POC code. The key caveat: this is NOT a flaw in all Agnai deployments - it is specific to instances deployed with the shipped self-host.docker-compose.yml using the unchanged fixed admin password and public JWT secret, which materially limits the real-world exposed population versus the raw 9.3 score. Treat as high priority for anyone running the self-host compose file as-is; lower priority where secrets were overridden.

An attacker locates an internet-exposed Agnai instance deployed from the default self-host.docker-compose.yml, then either logs in with the fixed admin password or uses the publicly known JWT secret to sign a token containing admin:true. With admin access they reset user passwords, impersonate accounts, and alter server configuration. A public hackmd write-up documents the hard-coded secret, so the technique is already described even though no formal exploit tool is flagged in the input.