Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-08 | 2 | Disclosure2 |
| 2026-09-11 | 1 | Patch1 |
🚨 CRITICAL: CVE-2026-86543 (CVSS 9.8) knowns <0.30.0 exposes unauthenticated management API on all interfaces. Attackers can provision public tunnels via /api/tunnel/start endpoint. Upgrade to v0.30.0+ immediately. #CVE #Vulnerability #PatchNow https://t.co/t9RXdb3z5m
Post summary
The tweet announces CVE-2026-86543, detailing an unauthenticated management API flaw, and urges users to upgrade to v0.30.0+ to apply the patch.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 8 Sep 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🕳️ Database dump left readable in the web root — every stored record, password hashes included, from one anonymous GET (code-projects CVE-2026-86519) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🖥️ Management API serving with no password set — full workspace and config control, plus a one-call public tunnel that puts the open instance on the internet (knowns CVE-2026-86543) 🖥️ Setup wizard still reachable on an unconfigured server — gives up the exact build number, and leaves the first admin account there for the taking (JetBrains YouTrack) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM
Post summary
The post announces new CVEs and supplies technical exploitation details, but does not offer PoC code, active exploitation evidence, or a patch.
CVE-2026-86543 knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. … https://www.cve.org/CVERecord?id=CVE-2026-86543
Post summary
CVE‑2026‑86543 permits unauthenticated access to the management API across all network interfaces on software versions before 0.30.0, presenting a significant risk if a new instance is installed without credentials.