Logseq: Authentication bypass in Local HTTP API (CVE-2026-124573)
Logseq versions 2.0.1 and 2.0.2 contain an authentication bypass vulnerability in the Local HTTP API that allows remote, unauthenticated access to the application.
CVE search metadata
CVE search record: CVE-2026-124573. Severity: high. CVSS: 7.3. KEV: no. Product: Logseq (2.0.1, 2.0.2). Brief: Logseq: Authentication bypass in Local HTTP API (CVE-2026-124573). Brief link: https://feed.craftedsignal.io/briefs/2026-11-logseq-auth-bypass/
Triage facts
Revision 1- Applicability
- Logseq (2.0.1, 2.0.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 07:31 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A vulnerability exists in the Logseq Local HTTP API component, specifically within the 'validate-auth-token' function located in 'src/electron/electron/server.cljs'. The flaw allows for missing authentication, permitting remote attackers to interact with the API without valid credentials. This vulnerability has an existing public exploit. As of the time of reporting, the vendor has not responded to the initial issue disclosure.
Impact
The vulnerability allows remote, unauthenticated access to the Logseq Local HTTP API, which may lead to unauthorized data access or manipulation within the application depending on the API's capabilities.
Recommendation
- Inventory all instances of Logseq running with the Local HTTP API enabled.
- Disable the Local HTTP API feature in affected versions (2.0.1 and 2.0.2) until a patch is released by the vendor.
- Restrict network access to the Local HTTP API port to only trusted local interfaces if the feature must remain enabled.
Immediate actions
Disable the Local HTTP API feature in Logseq 2.0.1 and 2.0.2
Threat Hunt
Monitor for unexpected inbound network connections to the port used by the Logseq Local HTTP API
Data: Network firewall or host-based firewall logs
Mitigations
Disable the Local HTTP API if not strictly required
CVE-2026-124573