Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-39386— Neko has Self-service Privilege Escalation for Authenticated Users

Quick assessment

Affected
m1k1o neko
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

n.eko是Miroslav Šedivý个人开发者的一个基于Docker和WebRTC的自托管虚拟浏览器。 n.eko 3.0.0版本至3.0.10版本和3.1.0版本至3.1.1版本存在输入验证错误漏洞，该漏洞源于任何经过身份验证的用户可以立即获得整个Neko实例的完全管理控制权，可能导致实例被完全破解。

CVSS 8.8 · High EPSS 0.64% · P50
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-39386

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Neko has Self-service Privilege Escalation for Authenticated Users
Source: CVE Program / CVE List V5
Vulnerability Description
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance. The vulnerability has been patched in v3.0.11 and v3.1.2. If upgrading is not immediately possible, the following mitigations can reduce risk: Restrict access to trusted users only (avoid granting accounts to untrusted parties); ensure all user passwords are strong and only shared with trusted individuals; run the instance only when needed; avoid leaving it continuously exposed; place the instance behind authentication layers such as a reverse proxy with additional access controls; disable or restrict access to the /api/profile endpoint if feasible; and/or monitor for suspicious privilege changes or unexpected administrative actions. Note that these are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
n.eko 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
n.eko是Miroslav Šedivý个人开发者的一个基于Docker和WebRTC的自托管虚拟浏览器。 n.eko 3.0.0版本至3.0.10版本和3.1.0版本至3.1.1版本存在输入验证错误漏洞，该漏洞源于任何经过身份验证的用户可以立即获得整个Neko实例的完全管理控制权，可能导致实例被完全破解。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
m1k1o neko >= 3.0.0, < 3.0.11 -

II. Public POCs for CVE-2026-39386

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-39386

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same vendor: m1k1o
Same weakness: CWE-20

V. Comments for CVE-2026-39386

No comments yet

Leave a comment