CVE-2026-108753

Name of the Vulnerable Software and Affected Versions Agnaistic agnai versions prior to 1.0.556

Description The self-hosted deployment configuration contains hard-coded credentials within the self-host.docker-compose.yml file, specifically a fixed administrator password and a public JSON Web Token (JWT) secret. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. Unauthenticated remote attackers can use these default credentials to log in as an administrator or forge JWT tokens with admin: true to impersonate users, reset passwords, and modify server configurations.

Recommendations Replace the default administrator credentials and JWT secrets. Restrict administrative access to trusted networks. Invalidate existing sessions and review account changes for unauthorized administrative operations. Avoid exposing example deployments to the internet without changing the default configuration.