Attack Chain

1. Attacker performs network reconnaissance to identify Mockoon instances running on default port 3000 or via local browser-based discovery.
2. Attacker interacts with /mockoon-admin/env-vars/ endpoints via standard HTTP methods (GET/POST) without authentication to identify and exfiltrate secrets stored as MOCKOON_* variables.
3. Attacker uses POST /mockoon-admin/env-vars/ to inject or overwrite arbitrary process-level environment variables, potentially influencing the host runtime or subsequent SDK operations.
4. Attacker utilizes PUT /mockoon-admin/environment to rewrite mock configurations, modifying body contents, status codes, and HTTP headers of downstream mock routes.
5. Attacker leverages wildcard CORS headers to execute cross-origin requests from a malicious webpage, bypassing browser same-origin policies if the developer interacts with the site.
6. Attacker observes live traffic and sensitive client auth headers (e.g., Authorization tokens, Cookies) by querying /mockoon-admin/logs or subscribing to the SSE stream at /mockoon-admin/events.
7. Final objective is achieved, ranging from credential theft and data exfiltration to complete supply-chain compromise via manipulated mock responses served to integration partners.

Impact

Successful exploitation allows for the theft of local development secrets, poisoning of production-like staging environments, and the modification of mock responses to inject malicious payloads into downstream testing or CI/CD pipelines. Exposure in CI/CD environments provides a pathway to steal cloud infrastructure credentials or perform man-in-the-middle attacks on internal development tools.

Recommendation

Prioritized actions for security teams:

• Update all instances of @mockoon/cli and @mockoon/commons-server to version 9.7.0 or later immediately to patch CVE-2026-59148.
• Audit CI/CD pipelines for exposed Mockoon services; ensure that if the admin API is not strictly required, it is disabled using the --disable-admin-api flag.
• Implement network-level restrictions using firewall rules to limit access to the Mockoon admin port (default 3000) to only trusted management subnets.
• Scan for and rotate any environment variables that were hosted in Mockoon environments potentially accessible to unauthorized network traffic, particularly cloud provider keys and JWT secrets.