CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-67594 — Spikster through commit e1cdf8c contains a missing authentication vulnerability ...

·Source: NIST NVD

Updated:

Executive Summary

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root pass

Analysis

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users. CVSS Score: 9.8. Published: 2026-07-30T20:18:15.173.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67594
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs

CISA is urging water and wastewater utilities to lock down internet-exposed controllers, days after intrusions hit dozens of Minnesota systems. The post CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

JetBrains warns of critical TeamCity remote code execution flaw

JetBrains is warning of a critical authentication bypass vulnerability affecting TeamCity On-Premises that could be exploited to achieve remote code execution. [...]

BleepingComputer
MEDIUMVulnerability

FTC Sues Telehealth Firm Hims & Hers Over Data Sharing

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ftc-sues-telehealth-firm-hims-hers-over-data-sharing-image_small-1-a-32376.jpg" align=right hspace=4><b>Feds May Renew Crackdown on Violations Related to Online Health Data Trackers</b><br>The Federal Trade Commission, along with Utah and California, have filed a lawsuit against telehealth firm Hims & Hers accusing the company of

Bank Info Security