CVE-2026-29023 Details
Description
Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the router port can proxy requests through the Shannon instance using the victim’s configured upstream provider API credentials, resulting in unauthorized API usage and potential disclosure of proxied request and response data. This vulnerability's general exploitability has been mitigated with the introduction of commit 023cc95.
A vulnerability exists in Keygraph Shannon due to a hard-coded API key in the router configuration. This key, which is publicly available, allows network attackers to authenticate and proxy requests through the Shannon instance using the victim's upstream provider API credentials. The issue arises when the router component is enabled and exposed, enabling unauthorized API usage and potential disclosure of proxied request and response data. The vulnerability affects Keygraph Shannon versions prior to the commit that introduced mitigation measures.
Users are advised to update to the latest version of Keygraph Shannon, where this vulnerability has been addressed by binding all ports to localhost, removing the hard-coded API key, and adding a path traversal guard to validate included file paths.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 9, 2026CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/KeygraphHQ/shannon/issues/186 | [email protected] | Issue TrackingTechnical AnalysisVendor |
| https://github.com/KeygraphHQ/shannon/pull/224 | [email protected] | Source CodeVendor |
| https://github.com/KeygraphHQ/shannon/pull/224/changes/023cc953db742602964b7826105278d15c28a420 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/keygraph-shannon-hard-coded-router-api-key | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Keygraph Shannon | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | New CVE Received | [email protected] |