CVE-2026-86543— knowns before 0.30.0 Unauthenticated Management API Exposure
Quick assessment
Affected
knowns-dev knowns
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在默认情况下，knowns 0.30.0 之前的版本会在所有网络接口上提供无需身份验证的管理 API，且新安装时不要求设置密码。攻击者可以利用未认证的 端点创建一个公共隧道，并将 API 重新发布到可公开访问的地址。
Possible ATT&CK Techniques 2 AI
T1041 · Exfiltration Over C2 Channel T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86543
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
knowns before 0.30.0 Unauthenticated Management API Exposure
Source: CVE Program / CVE List V5
Vulnerability Description
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| knowns-dev | knowns | 0 ~ 0.30.0 | - |
|
II. Public POCs for CVE-2026-86543
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86543
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86543 (4)
-
-
🔗 knowns/internal/cli/browser.go at v0.29.1 · knowns-dev/knowns · GitHub Read full article technical-description
-
-
🔗 knowns/internal/server/auth.go at v0.29.1 · knowns-dev/knowns · GitHub Read full article technical-description
Vendor Advisories for CVE-2026-86543 (2)
Vendor Pages for CVE-2026-86543 (1)
-
🔗 Release v0.30.0 · knowns-dev/knowns · GitHub release-notes
Same Patch Batch · knowns-dev · 2026-09-07 · 8 CVEs total
| CVE-2026-86542 | 9.1 CRITICAL | knowns before 0.30.0 Path Traversal via Import Name |
| CVE-2026-86439 | 8.8 HIGH | knowns before 0.30.0 Path Traversal via MCP doc and memory tools |
| CVE-2026-86541 | 8.3 HIGH | knowns before 0.30.0 Path Traversal via code.replace MCP action |
| CVE-2026-86544 | 8.1 HIGH | knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions |
| CVE-2026-86540 | 7.8 HIGH | knowns before 0.30.0 Arbitrary Code Execution via LSP Binary |
| CVE-2026-86538 | 7.5 HIGH | knowns before 0.30.0 Path Traversal via templateFile parameter |
| CVE-2026-86539 | 7.2 HIGH | knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint |
IV. Related Vulnerabilities
Same product: knowns
-
CVE-2026-86544
knowns before 0.30.0 Authorization Bypass via Misclassified -
CVE-2026-86542
knowns before 0.30.0 Path Traversal via Import Name -
CVE-2026-86540
knowns before 0.30.0 Arbitrary Code Execution via LSP Binary -
CVE-2026-86541
knowns before 0.30.0 Path Traversal via code.replace MCP act -
CVE-2026-86539
knowns through 0.33.0 Server-Side Request Forgery via embedd
Same vendor: knowns-dev
-
CVE-2026-86544
knowns before 0.30.0 Authorization Bypass via Misclassified -
CVE-2026-86542
knowns before 0.30.0 Path Traversal via Import Name -
CVE-2026-86540
knowns before 0.30.0 Arbitrary Code Execution via LSP Binary -
CVE-2026-86541
knowns before 0.30.0 Path Traversal via code.replace MCP act -
CVE-2026-86539
knowns through 0.33.0 Server-Side Request Forgery via embedd
V. Comments for CVE-2026-86543
No comments yet