CVE-2026-63406

Name of the Vulnerable Software and Affected Versions AnyCable versions prior to 1.6.15

Description The telemetry subsystem contains a hardcoded authentication token in telemetry/config.go used to authenticate to https://telemetry.anycable.io. Additionally, the clusterFingerprint() function in telemetry/telemetry.go processes the full configuration file and raw command-line arguments via anycableCLIArgs(), including sensitive values passed through --secret, --jwt secret, and --http rpc secret. These raw inputs are passed to the generateDigest() function to create a hexadecimal fingerprint sent as telemetry. Because the authentication token is public, an attacker capable of DNS hijacking or network interception could potentially intercept the telemetry payload containing data derived from operator credentials.

Recommendations Update to version 1.6.15. As a temporary mitigation, avoid using the --secret, --jwt secret, and --http rpc secret flags when starting the server until the update is applied.