CVE-2026-86543

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, and fresh installations require no password, leaving the API reachable by anyone who can access the host's network (CWE-306, missing authentication for a critical function). An attacker with network access to the service can invoke the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the management API at a publicly accessible address. The CVSS 4.0 score of 9.3 (critical) reflects high confidentiality, integrity, and availability impact on the vulnerable system, indicating the exposed API grants an attacker substantial control over the deployment. Any deployment running a version prior to 0.30.0 is affected, with fresh installations left at default settings at greatest risk, particularly where the management interface is reachable beyond the local network. No public proof of concept is known, the issue is not in CISA KEV, and EPSS estimates a 0.4% probability of exploitation within 30 days, so exploitation has not yet been widely observed.

What to do: Upgrade knowns to version 0.30.0 or later. Until upgraded, restrict access to the management API via firewall rules or access control lists, bind it to a trusted or local interface where possible, and configure authentication on instances currently running without a password. Review logs for calls to /api/tunnel/start and verify that no unexpected public tunnels or republished API endpoints exist.