PT-2026-109664 · Chenhg5 · Cc-Connect
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user id to run privileged commands like /shell on the host.
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cc-Connect