Unauthenticated Admin API Exposure in Mockoon

Mockoon, a popular mock server tool, contains a critical security vulnerability in its admin API, which is enabled by default across all runtimes, including @mockoon/commons-server, the CLI, and serverless deployments. The admin API, located at /mockoon-admin/, lacks any form of authentication or authorization, allowing any unauthenticated user with network access to the server (defaulting to 0.0.0.0:3000) to manipulate the service. Furthermore, the API endpoints explicitly set Access-Control-Allow-Origin: *, which permits browser-based attackers to interact with the admin API cross-origin via CSRF. This flaw allows an attacker to steal sensitive MOCKOON_* environment variables, inject arbitrary process-level environment variables (e.g., AWS_SECRET_ACCESS_KEY), rewrite mock API responses, and harvest sensitive data from transaction logs or Server-Sent Events (SSE). The vulnerability, tracked as CVE-2026-59148, affects all versions prior to 9.7.0.

Attack Chain

1. Attacker performs network reconnaissance to identify Mockoon instances running on default port 3000 or via local browser-based discovery.
2. Attacker interacts with /mockoon-admin/env-vars/ endpoints via standard HTTP methods (GET/POST) without authentication to identify and exfiltrate secrets stored as MOCKOON_* variables.
3. Attacker uses POST /mockoon-admin/env-vars/ to inject or overwrite arbitrary process-level environment variables, potentially influencing the host runtime or subsequent SDK operations.
4. Attacker utilizes PUT /mockoon-admin/environment to rewrite mock configurations, modifying body contents, status codes, and HTTP headers of downstream mock routes.
5. Attacker leverages wildcard CORS headers to execute cross-origin requests from a malicious webpage, bypassing browser same-origin policies if the developer interacts with the site.
6. Attacker observes live traffic and sensitive client auth headers (e.g., Authorization tokens, Cookies) by querying /mockoon-admin/logs or subscribing to the SSE stream at /mockoon-admin/events.
7. Final objective is achieved, ranging from credential theft and data exfiltration to complete supply-chain compromise via manipulated mock responses served to integration partners.

Impact

Successful exploitation allows for the theft of local development secrets, poisoning of production-like staging environments, and the modification of mock responses to inject malicious payloads into downstream testing or CI/CD pipelines. Exposure in CI/CD environments provides a pathway to steal cloud infrastructure credentials or perform man-in-the-middle attacks on internal development tools.

Recommendation

Prioritized actions for security teams:

• Update all instances of @mockoon/cli and @mockoon/commons-server to version 9.7.0 or later immediately to patch CVE-2026-59148.
• Audit CI/CD pipelines for exposed Mockoon services; ensure that if the admin API is not strictly required, it is disabled using the --disable-admin-api flag.
• Implement network-level restrictions using firewall rules to limit access to the Mockoon admin port (default 3000) to only trusted management subnets.
• Scan for and rotate any environment variables that were hosted in Mockoon environments potentially accessible to unauthorized network traffic, particularly cloud provider keys and JWT secrets.