CVE-2026-86543 — knowns before 0.30.0 Unauthenticated Management API Exposure
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers c…
Published: 2026-09-07 · CVSS: 9.3 · CVSS 4.0
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7