CVE-2026-112147 Details
Description
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.
A vulnerability allowing unauthenticated arbitrary file read has been identified in AI Genius Automations Octoally versions prior to 1.0.88. The issue arises because the Octoally backend service, by default, listens on all network interfaces, making it accessible from other devices on the local network. This exposure allows attackers to read sensitive files through the API, such as SSH keys, shell history, and environment files. The vulnerability has been publicly disclosed and can be exploited remotely from the local network.
Users are advised to upgrade to Octoally version 1.0.88, which binds the server to localhost only, rejects non-local Host and Origin headers, and removes the unused OCTOALLY_TOKEN setting from the documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ai-genius-automations/octoally/ | [email protected] | ProductVendor |
| https://github.com/ai-genius-automations/octoally/commit/3898085c4e701be21377ebd9e91e10b941e47168 | [email protected] | Source CodeVendor |
| https://github.com/ai-genius-automations/octoally/issues/24 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ai-genius-automations/octoally/releases/tag/v1.0.88 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-112147 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1013490 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/submit/1013491 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/422254 | [email protected] | Content Wall |
| https://vuldb.com/vuln/422254/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ai-genius-automations OctoAlly | <= 1.0.87 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |