CVE-2026-59148 Details
Description
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.
A vulnerability exists in Mockoon versions prior to 9.7.0, where the admin API is exposed without authentication on the same Express listener as user-defined mock routes. This configuration, enabled by default, allows any unauthenticated caller to access sensitive environment variables, manipulate process environment variables, modify mock route responses in real-time, and disrupt the application's state. The issue arises from the lack of authentication and permissive CORS settings, which together create a significant security risk, especially in network-exposed deployments.
Users are advised to update Mockoon to version 9.7.0, which introduces authentication for the admin API, removes default CORS headers, and fixes the environment variable update process to prevent overwriting unrelated variables.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299 | [email protected] | Source CodeVendor |
| https://github.com/mockoon/mockoon/pull/2254 | [email protected] | Source CodeVendor |
| https://github.com/mockoon/mockoon/releases/tag/v9.7.0 | [email protected] | Release NotesVendor |
| https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v | [email protected] | AdvisoryExploitRemedyVendor |
| https://mockoon.com/releases/9.7.0 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mockoon | < 9.7.0 (semver) |
CPE
Remediation
| |
| Mockoon CLI | 9.6.1 (semver) |
CPE
Remediation
| |
| Mockoon Commons Server | 9.6.1 (semver) 9.7.0 (semver) |
CPE
Remediation
| |
| Mockoon Serverless | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |