Vulnerability · Published Sep 7, 2026 · Assigned by VulnCheck
CVE-2026-86543knowns before 0.30.0 Unauthenticated Management API Exposure
Critical 9.8
In plain English
A critical-severity missing authentication in knowns from knowns-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 41.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| knowns-dev | knowns | 0 – before 0.30.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-fc85-99vc-9c75) vendor-advisory
- AuthManager.Middleware is a no-op when no password is configured (v0.29.1) technical-description
- Browser listener binds 0.0.0.0 (v0.29.1) technical-description
- POST /api/tunnel/start has no authorization check of its own (v0.29.1) technical-description
- knowns fix commit 878a02cb7cc1 patch
- knowns v0.30.0 Release Notes release-notes
- VulnCheck Advisory: knowns before 0.30.0 Unauthenticated Management API Exposure third-party-advisory