Description

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-07T23:16:54.160Z",
  "pubdate": "2026-09-07T23:16:54.160Z",
  "executiveSummary": "This vulnerability involves an Improper Authentication flaw affecting knowns versions prior to 0.30.0, resulting in the exposure of the management API interface on all network interfaces by default.\nThe vulnerability allows unauthorized remote actors to gain control over the application's tunnel provisioning capabilities without requiring any form of credential verification.\nThe primary risk stems from the lack of access controls on the /api/tunnel/start endpoint, which enables unauthenticated attackers to programmatically create and expose internal services to the public internet.\nThis facilitates unauthorized tunnel establishment, potentially leading to full service exposure or the redirection of management traffic to attacker-controlled infrastructure.\nBecause the management API defaults to binding on all network interfaces upon fresh installation, the attack surface is globally exposed in default deployment configurations.\nExploitation does not require prior knowledge of the target environment, as the vulnerability is inherent to the default configuration of the affected software versions.",
  "technicalDetails": "The vulnerability originates from a critical oversight in the knowns management API authorization logic, which fails to enforce authentication checks for sensitive administrative endpoints in versions before 0.30.0.\nBy default, the application binds the management service to all available network interfaces (0.0.0.0), rendering it reachable to any party with network connectivity to the host.\nThe specific endpoint, /api/tunnel/start, is designed to facilitate the provisioning of public tunnels. Due to the absence of middleware or authentication decorators, the API process executes these requests without verifying the caller's identity or authorization status.\nAn attacker can exploit this by sending a crafted HTTP request to the /api/tunnel/start endpoint. The payload structure allows the remote actor to define tunnel parameters, effectively provisioning a public-facing bridge to the internal service.\nThe attack flow follows a predictable sequence: First, the attacker performs network reconnaissance to identify the presence of the management API on the target host. Second, the attacker issues a POST request to the unauthenticated /api/tunnel/start endpoint. Third, the application processes the request, creates the tunnel, and generates a publicly accessible URL for the internal management API.\nOnce the tunnel is active, the attacker can leverage the newly established public address to bypass existing network-level perimeter defenses, such as firewalls or VPC rules, that might otherwise restrict access to the management service.\nPost-exploitation, the attacker gains full control over the tunnel configuration and can republish the management API, effectively exposing the backend to the public internet indefinitely. This grants the attacker the ability to interact with the API as a high-privileged user, leading to potential full system compromise depending on the API's available administrative functions.\nThis vulnerability is classified as a critical authentication bypass, as it circumvents the fundamental security boundary intended to protect sensitive management functionality."
}