Critical severity · published Sep 7, 2026
CVE-2026-86543
knowns before 0.30.0 Unauthenticated Management API Exposure
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KN
knowns · knowns-dev
before 0.30.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86543
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86543
github.com
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go#L193-L200
github.com
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go#L80-L86
github.com
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/tunnel.go#L26-L38
github.com
https://github.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fb
github.com
https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
github.com
https://github.com/knowns-dev/knowns/security/advisories/GHSA-fc85-99vc-9c75
More from knowns
9.8
CVE-2026-88899
knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
9.1
CVE-2026-86542
knowns before 0.30.0 Path Traversal via Import Name
8.8
CVE-2026-88937
knowns through 0.33.0 Path Traversal via Template Engine
8.8
CVE-2026-86439
knowns before 0.30.0 Path Traversal via MCP doc and memory tools
8.6
CVE-2026-86775
knowns before 0.30.0 Path Traversal via Document API