CVE-2026-45577 Details
Description
Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolve unauthenticated requests as the local development user, making the hosted Inspector and related API surface reachable without credentials. This vulnerability is fixed in 0.11.1.
An authentication bypass vulnerability has been identified in Neotoma versions 0.6.0 prior to 0.11.1. The issue arises when public reverse-proxied requests are received over a loopback socket without a Bearer token, leading the application to mistakenly treat these requests as local. This allows unauthenticated access to the hosted Inspector and related API, as the REST authentication middleware can incorrectly resolve such requests as coming from the local development user.
Users can upgrade to Neotoma version 0.11.1 or later to address this vulnerability. For deployments behind a trusted auth layer or reverse proxy, the loopback trust can be re-enabled with the 'NEOTOMA_TRUST_PROD_LOOPBACK=1' environment variable, after ensuring that only trusted local hops reach the Node process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/markmhendrickson/neotoma/releases/tag/v0.11.1 | [email protected] | Release NotesVendor |
| https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-5cvp-p7p4-mcx9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Neotoma | >= 0.6.0, < 0.11.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |