{"id":"CVE-2026-108549","published":"2026-10-10T15:16:57.973","lastModified":"2026-10-13T12:17:12.747","description":"cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/chenhg5/cc-connect","tags":[]},{"url":"https://github.com/chenhg5/cc-connect/blob/v1.5.0/platform/max/max.go#L287-L305","tags":[]},{"url":"https://github.com/chenhg5/cc-connect/issues/1968","tags":[]},{"url":"https://www.vulncheck.com/advisories/cc-connect-through-1.5.0-missing-authentication-via-max-webhook-sender-spoofing","tags":[]}],"exploitRefs":[{"url":"https://github.com/chenhg5/cc-connect","tags":[]},{"url":"https://github.com/chenhg5/cc-connect/blob/v1.5.0/platform/max/max.go#L287-L305","tags":[]},{"url":"https://github.com/chenhg5/cc-connect/issues/1968","tags":[]}],"hasPoc":true,"ai":{"summary":"The cc-connect application has a critical authentication bypass vulnerability in its MAX platform adapter webhook mode that allows unauthenticated remote attackers to forge privileged updates and execute shell commands on the host. This occurs when no webhook_secret is configured, making the webhook listener on port 8080 completely open to unauthorized modifications.","exploitability":"Exploitation is straightforward for remote attackers who can reach port 8080, requiring no authentication credentials or preconditions beyond network access to the webhook endpoint.","blast_radius":"The vulnerability could lead to full system compromise as attackers can execute arbitrary shell commands with admin privileges, potentially allowing them to gain complete control over the host system.","remediation":"Disable webhook mode in MAX platform adapter or configure a webhook_secret immediately, as no fixed version is published for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","webhook","rce"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:54.155Z"}}