🚨High - Mockoon Unauthenticated Admin API Exposure (CVE-2026-59148) Mockoon's admin API is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port gains full control of it. That means reading MOCKOON_* env vars, writing arbitrary process environment variables via /mockoon-admin/env-vars, rewriting mock route bodies/statuses/headers via PUT /mockoon-admin/environment, reading transaction logs and SSE streams, and purging state. The wildcard CORS also opens a cross-origin/CSRF path through a victim's browser. 👉Upgrade Mockoon to 9.7.0.
Post summary
The post advertises CVE‑2026‑59148, an unauthenticated admin API exposure in Mockoon, and urges users to upgrade to v9.7.0 to remediate the flaw.