{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/nullhub/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nullhub:nullhub:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110616"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NullHub (\u003c= 2026.5.29)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["NullHub"],"content_html":"\u003cp\u003eNullHub versions 2026.5.29 and earlier are affected by an authentication bypass vulnerability (CVE-2026-110616). The flaw stems from an improperly initialized 'auth_token' field within the application's management API (/api/*), which defaults to null and remains unassigned during operation. This allows unauthenticated attackers to interact with the management interface by sending HTTP requests that lack 'Authorization' or 'Origin' headers.\u003c/p\u003e\n\u003cp\u003eWhen the service is configured to listen on non-loopback interfaces, an attacker can gain unauthorized control over agent instances. Successful exploitation enables an attacker to rewrite configuration files, extract sensitive provider credentials, manage cron jobs, and manipulate MCP (Model Context Protocol) servers. Given the critical nature of these functions, this vulnerability allows for complete compromise of the affected NullHub instance and potential lateral movement into integrated systems. Organizations should restrict management API access to loopback interfaces as an immediate mitigation until patching is performed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full unauthorized control over NullHub agent instances. Attackers can exfiltrate provider credentials, establish persistence via modified cron jobs, and execute arbitrary commands through malicious MCP server configurations. This impacts any organization using NullHub for automation or agent management, particularly those exposing the management API to wider network segments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch NullHub to a version beyond 2026.5.29 immediately.\u003c/li\u003e\n\u003cli\u003eRestrict access to the NullHub management API (/api/*) to local loopback interfaces only.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for HTTP requests to /api/* paths originating from external IP addresses that lack 'Authorization' headers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:36:40Z","date_published":"2026-10-14T16:36:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nullhub-auth-bypass/","summary":"NullHub versions through 2026.5.29 contain a missing authentication vulnerability allowing unauthenticated remote access to management API endpoints.","title":"Authentication Bypass in NullHub Management API","url":"https://feed.craftedsignal.io/briefs/2026-10-nullhub-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - NullHub","version":"https://jsonfeed.org/version/1.1"}