The knowns application before version 0.30.0 exposes an unauthenticated management API on all network interfaces, allowing attackers to provision unauthorized tunnels via the /api/tunnel/start endpoint.
knowns +1
web-vulnerability
path-traversal
npm
cve-2026-86775
2r
2t
1c
updated