CVE-2026-105858: Payload CMS RCE Vulnerability

CVE-2026-105858 Overview

CVE-2026-105858 is a remote code execution vulnerability in Payload, a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely. The condition requires local authentication to be enabled and no initial user to have been created. The flaw is tracked as CWE-94: Improper Control of Generation of Code and is fixed in 3.90.0 and 4.0.0-canary.34.

Critical Impact

Unauthenticated attackers can achieve remote code execution on Payload CMS instances that expose the first-register endpoint before an administrator account has been created.

Affected Products

• Payload CMS versions prior to 3.90.0
• Payload CMS canary versions prior to 4.0.0-canary.34
• Deployments with local authentication enabled and no initial user provisioned

Discovery Timeline

• 2026-10-06 - CVE CVE-2026-105858 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105858

Vulnerability Analysis

Payload exposes a public first-register operation designed to let an administrator create the initial user during bootstrap. When local authentication is enabled and no user has yet been created, the endpoint accepts unauthenticated input. A crafted request can abuse this operation to inject and execute code within the server process.

Because the vulnerable code path runs before any identity enforcement, an attacker reaching the Payload admin surface over the network can trigger it without credentials. Successful exploitation yields code execution in the context of the Node.js process hosting Payload, exposing data stores, environment secrets, and downstream services.

Root Cause

The root cause is improper restriction of the public admin verification routes used during first-user registration. The patch adjusts packages/next/src/utilities/isPublicAdminRoute.ts to narrow the set of routes treated as publicly accessible, preventing the first-register flow from being abused as a code-execution entrypoint.

Attack Vector

Exploitation is remote and does not require authentication or user interaction. The attacker must reach the Payload admin HTTP endpoints and the target must have local authentication enabled with no initial user present. Attack complexity is elevated because exploitation depends on the uninitialized-user window.

// Security patch excerpt from packages/next/src/utilities/isPublicAdminRoute.ts
import { getRouteWithoutAdmin } from './getRouteWithoutAdmin.js'

-// Routes that require admin authentication
+// Routes that are accessible without admin authentication
const publicAdminRoutes: (keyof Pick<
  SanitizedConfig['admin']['routes'],
  'createFirstUser' | 'forgot' | 'inactivity' | 'login' | 'logout' | 'reset' | 'unauthorized'

Source: Payload commit e947fc4. The patch restricts which admin routes are treated as public, closing the pre-authentication path that enabled remote code execution.

Detection Methods for CVE-2026-105858

Indicators of Compromise

• Unexpected HTTP requests to the Payload first-register or createFirstUser admin route from external IP addresses
• Creation of new administrative user accounts outside of planned deployment windows
• Child processes spawned by the Node.js Payload server (for example, sh, bash, curl, wget, node -e)
• Outbound network connections from the Payload process to attacker-controlled hosts shortly after a first-register request

Detection Strategies

• Alert on any HTTP POST to the Payload admin registration endpoint on production servers where an initial user already exists
• Baseline the Payload Node.js process and flag deviations such as new child processes or unusual filesystem writes
• Correlate web access logs with endpoint telemetry to link suspicious first-register requests to subsequent process activity

Monitoring Recommendations

• Centralize Payload application and reverse-proxy logs and retain them long enough to investigate pre-bootstrap exposure
• Monitor for Payload instances deployed without an initial admin user and track time-to-bootstrap as a risk metric
• Track installed Payload versions across environments and alert when any instance falls below 3.90.0

How to Mitigate CVE-2026-105858

Immediate Actions Required

• Upgrade Payload to version 3.90.0 or later, or canary 4.0.0-canary.34 or later
• Audit all Payload deployments to confirm an initial administrator user has been created before the service is exposed to untrusted networks
• Review logs for prior requests to the first-register endpoint and investigate any unexpected admin user creation
• Rotate secrets, API keys, and database credentials accessible to any Payload instance that was exposed before patching

Patch Information

The fix is published in Payload v3.90.0 and canary 4.0.0-canary.34. Technical details are documented in GitHub Security Advisory GHSA-97rh-rhh2-7vjv and the corresponding commit e947fc4.

Workarounds

• Restrict network access to the Payload admin routes using firewall rules or a reverse-proxy allowlist until patching is complete
• Provision the initial administrator user immediately after deployment to close the uninitialized-user window
• Disable local authentication where an external identity provider can be used instead, if the deployment supports it

# Example nginx snippet to restrict the Payload first-register endpoint to trusted IPs
location = /admin/first-register {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://payload_upstream;
}