Nullhub
Monthly
Missing authentication in NullHub through 2026.5.29 exposes the /api/* management API, so any remote attacker who can reach the listener can control agent instances, rewrite configuration including provider credentials, and manage cron jobs and MCP servers. The root cause is the auth_token field defaulting to null and never being assigned, meaning requests sent without Authorization and Origin headers are accepted without credentials (CWE-306). Exploitation requires the API to be bound to a non-loopback interface - the deployment pattern reflected in the project's Dockerfile - and once that exposure exists there are no further attacker prerequisites; severity is rated 9.2 and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as a genuine high-priority issue rather than a CVSS-inflated one. No public exploit code was identified at the time of analysis, and the issue is not confirmed as actively exploited.
Missing authentication in NullHub through 2026.5.29 exposes the /api/* management API, so any remote attacker who can reach the listener can control agent instances, rewrite configuration including provider credentials, and manage cron jobs and MCP servers. The root cause is the auth_token field defaulting to null and never being assigned, meaning requests sent without Authorization and Origin headers are accepted without credentials (CWE-306). Exploitation requires the API to be bound to a non-loopback interface - the deployment pattern reflected in the project's Dockerfile - and once that exposure exists there are no further attacker prerequisites; severity is rated 9.2 and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as a genuine high-priority issue rather than a CVSS-inflated one. No public exploit code was identified at the time of analysis, and the issue is not confirmed as actively exploited.