AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-110616highSecret exposure2026-10-14

CVE-2026-110616: NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned.

01.

What it is

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

02.

How to check

  1. Compare your installed version with the range above (command below).
03.

How to fix

    04.

    Sources

    More advisories for this tool
    The weekly email

    One email a week. Only what changed.

    Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

    Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.