CVE-2026-110616 — NullHub through 2026.5.29 Missing Authentication for /api Management API
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field …
Published: 2026-10-14 · CVSS: 9.2 · CVSS 4.0
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7