Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-54650 path traversal in openhole-server exposes local services https://ift.tt/e01fDVs
Post summary
CVE‑2026‑54650 is a path‑traversal flaw in openhole‑server that permits local service exposure.
🚨*CVE* CVE-2026-54650 openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of pr… https://www.cve.org/CVERecord?id=CVE-2026-54650 ----- Traducción: CVE-2026-54650 ope… http://infoflow.cloud`
Post summary
The tweet discloses CVE‑2026‑54650, describing how a URL‑path forwarding flaw in openhole‑server can expose localhost to the internet, but it does not provide a PoC, exploit code, or patch information.
CVE-2026-54650 openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of pr… https://www.cve.org/CVERecord?id=CVE-2026-54650
Post summary
The post describes CVE‑2026‑54650 as a vulnerability where a single command can expose localhost to the internet, but it does not provide a PoC, exploit code, patches, or evidence of active exploitation.