CVE-2026-108753 — Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthe…
Published: 2026-10-11 · CVSS: 9.3 · CVSS 4.0
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7