CVE-2026-110616 Details
Description
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
A missing authentication vulnerability has been identified in NullHub versions through 2026.5.29. The issue arises because the 'auth_token' field is not properly initialized, defaulting to null. As a result, unauthenticated attackers can access the '/api/*' management API on non-loopback listeners, without needing 'Authorization' or 'Origin' headers. This vulnerability allows attackers to control agent instances, modify configurations including provider credentials, and manage cron jobs and MCP servers.
To address this vulnerability, set the 'auth_token' to a secure value before starting the server, especially when binding to a non-loopback interface. Additionally, implement checks to require a valid token for all protected API routes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://github.com/nullclaw/nullhub | [email protected] | Vendor |
| https://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile#L69-L71 | [email protected] | Source CodeVendor |
| https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig#L29-L54 | [email protected] | Source CodeVendor |
| https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig#L546-L556 | [email protected] | Source CodeVendor |
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NullHub | <= 2026.5.29 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |