Vulnerability · Published May 29, 2026 · Assigned by GitHub_M
CVE-2026-45577Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Medium 6.9
In plain English
A medium-severity authentication bypass in neotoma from markmhendrickson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolve unauthenticated requests as the local development user, making the hosted Inspector and related API surface reachable without credentials. This vulnerability is fixed in 0.11.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | neotoma | 0.11.1 | GHSA-5cvp-p7p4-mcx9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| markmhendrickson | neotoma | >= 0.6.0, < 0.11.1 |
Weakness: CWE-288, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-5cvp-p7p4-mcx9 x_refsource_CONFIRM
- https://github.com/markmhendrickson/neotoma/releases/tag/v0.11.1 x_refsource_MISC