HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108549 — cc-connect through 1.5.0 contains a missing authentication vulnerability in the ...

·Source: NIST NVD

Updated:

Executive Summary

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

Analysis

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host. CVSS Score: 8.1. Published: 2026-10-10T15:16:57.973.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108549
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Acorns buys Gen Z social finance app Frich

Savings and investment app Acorns has acquired Gen Z-focused social finance app Frich. Financial terms of the deal were not disclosed.

Finextra
MEDIUMVulnerability

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]

BleepingComputer
MEDIUMVulnerability

Hackers exploit SiteGuard WAF flaw to run commands as admins

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]

BleepingComputer