Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-40885 Credential Leakage in goshs 2.0.0-beta.4 Through Unauthenticated Collaborator Feed https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40885
Post summary
CVE‑2026‑40885 reveals credential leakage in goshs 2.0.0‑beta.4 through an unauthenticated collaborator feed, with no PoC or patch information provided.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |