Knowns (< 0.30.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/knowns--0.30.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 01:37:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in knowns Management APIhttps://feed.craftedsignal.io/briefs/2026-09-knowns-auth-bypass/Tue, 08 Sep 2026 01:37:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-knowns-auth-bypass/The knowns application before version 0.30.0 exposes an unauthenticated management API on all network interfaces, allowing attackers to provision unauthorized tunnels via the /api/tunnel/start endpoint.The knowns application, in versions prior to 0.30.0, contains a critical authentication bypass vulnerability in its management API component. By default, this API is configured to listen on all network interfaces without requiring any form of authentication or credentials upon fresh installation. This misconfiguration allows unauthenticated remote attackers to interact with sensitive administrative endpoints. Specifically, an attacker can access the /api/tunnel/start endpoint to provision a new, unauthorized public tunnel. This action can be used to republish the internal management API to a publicly accessible address, effectively bypassing internal network boundaries and enabling further unauthorized access or control over the host system. Given the default behavior of exposing the API on all interfaces, this threat is highly accessible to any actor capable of reaching the service over the network.

Impact

Successful exploitation allows for the unauthorized creation of external tunnels, potentially exposing internal-only services or management interfaces to the public internet. This can lead to unauthorized configuration changes, complete takeover of the knowns application instance, and lateral movement within the network. This vulnerability carries a CVSS v3.1 base score of 9.8.

Recommendation

  • Upgrade the knowns application to version 0.30.0 or later immediately to enforce authentication requirements on the management API.
  • Implement network access control lists (ACLs) to restrict access to the knowns management API port to trusted internal management subnets only.
  • Review network logs for unexpected inbound HTTP requests to the /api/tunnel/start endpoint, which is a strong indicator of unauthorized tunnel provisioning.
]]>criticaladvisoryweb-vulnerabilitypath-traversalnpmcve-2026-86775CVE-2026-86542 Path Traversal in knowns Applicationhttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-86542-knowns-path-traversal/Mon, 07 Sep 2026 23:37:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-86542-knowns-path-traversal/An unauthenticated path traversal vulnerability in knowns versions prior to 0.30.0 allows attackers to overwrite arbitrary files on the server by supplying malicious traversal sequences in the import route name parameter.The knowns application, in versions prior to 0.30.0, contains a critical path traversal vulnerability (CVE-2026-86542) within its import route handling. The application fails to properly validate the 'name' parameter provided during an import operation. By supplying a specially crafted 'name' parameter containing directory traversal sequences (e.g., ../), an unauthenticated attacker can escape the intended 'imports' directory.

Successful exploitation results in the attacker having the ability to overwrite files anywhere on the filesystem that the server process has permissions to access. Because this can lead to remote code execution (e.g., by overwriting configuration files, startup scripts, or web application files), it poses a severe threat to organizations hosting this software. Defenders should prioritize patching knowns to version 0.30.0 or later to remediate the vulnerability.

Impact

Successful exploitation of CVE-2026-86542 allows an unauthenticated attacker to achieve arbitrary file overwrite on the underlying host. This level of access typically leads to complete compromise of the application instance, potential privilege escalation, and execution of arbitrary code, depending on the files accessible to the application's service account.

Recommendation

  • Patch the knowns application to version 0.30.0 or later immediately.
  • Audit file system access logs for any evidence of attempts to traverse paths using the '../' sequence within the application's import-related URI paths.
  • Implement strict input validation on the application front-end or Web Application Firewall (WAF) to block requests containing directory traversal patterns in URI parameters.
]]>criticaladvisoryremote-code-executioncvevulnerabilitypath-traversalmcp