CVE-2026-109823 Details
Description
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.
A vulnerability in Tidewave versions 0.8.0 prior to 0.9.2 allows attackers to read filesystem path names of the application through Tidewave configuration. This is possible via the '/tidewave/connect' endpoint or through the injected toolbar on other HTML routes. The vulnerability arises because the application does not validate the 'Host' header, enabling a web page to exploit DNS rebinding and make same-origin requests that lack an 'Origin' header. The exposed paths can reveal sensitive information such as the local username and project structure.
Users can update Tidewave to version 0.9.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-109823.html | EEF | AdvisoryExploit |
| https://github.com/tidewave-ai/tidewave_phoenix/commit/80159536f752dc4d34797934d1516f29cea12b50 | EEF | Source CodeVendor |
| https://github.com/tidewave-ai/tidewave_phoenix/commit/f78352b56d19cd4ae49999aa385011cef73e8b93 | EEF | Source CodeVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-109823 | EEF | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | EEF |
Affected Products
| Product | Versions |
|---|---|
| tidewave-ai tidewave | >= 0.8.0, < 0.9.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | EEF |