Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110616NullHub through 2026.5.29 Missing Authentication for /api Management API

High 8.1

In plain English

A high-severity missing authentication in NullHub from nullclaw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.0%top 38.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

Affected products (as reported)

Vendor	Product	Versions
nullclaw	NullHub	0 – through 2026.5.29

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg third-party-advisory
https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig#L546-L556 technical-description
https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig#L29-L54 technical-description
https://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile#L69-L71 technical-description
https://github.com/nullclaw/nullhub product
VulnCheck Advisory: NullHub through 2026.5.29 Missing Authentication for /api Management API third-party-advisory