CVE-2026-103057
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/
CVSS
4.3
Medio
EPSS
0.3%
p16
KEV
—
Exploit Today
5
0-100
Publicado: 30 sept 2026 · Última mod.: 30 sept 2026 · CWE-306
0.3%EPSS · 30 días0.3%
2026-09-302026-10-20
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
- github.comhttps://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts#L681-L691
- github.comhttps://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43
- github.comhttps://github.com/beenuar/AiSOC/releases/tag/v12.0.0
- github.comhttps://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37
- www.vulncheck.comhttps://www.vulncheck.com/advisories/aisoc-5.1.0-before-12.0.0-missing-authentication-on-realtime-service-internal-endpoints
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1141089.8 CRÍ—
——0HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.9hCVE-2026-1140926.5 MED—
——0Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.9hCVE-2026-1140907.1 ALT—
——0Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.9hCVE-2026-1140865.3 MED—
——0Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.9hCVE-2026-1140857.9 ALT—
——0Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.9hCVE-2026-1136483.1 BAJ—
——0ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.15h