CVE-2026-12888 Overview
CVE-2026-12888 is an HTML injection vulnerability in Thinkst Applied Research Canarytokens. The flaw resides in the Google Chat webhook notification path. An attacker can insert limited HTML content, including hyperlinks, into messages delivered to Google Chat clients. This enables interface manipulation against operators who view canary alert notifications. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).
Critical Impact
Attackers can manipulate the Google Chat interface presented to defenders by injecting HTML and links into Canarytokens webhook notifications, potentially aiding social engineering against alert recipients.
Affected Products
- Canarytokens Docker images from tag sha-4aef1db90 before sha-8ab4dccd
- Canarytokens Git commits from 4aef1db90 before 8ab4dccd
- Deployments using the Google Chat webhook notification channel
Discovery Timeline
- 2026-06-22 - CVE-2026-12888 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-12888
Vulnerability Analysis
Canarytokens generates alert notifications when a token is triggered. When the Google Chat webhook channel is configured, the application formats alert content and posts it to a Google Chat webhook endpoint. The vulnerability stems from insufficient neutralization of attacker-controllable fields before they are embedded into the outgoing Google Chat message body.
Google Chat renders a limited subset of HTML in webhook messages, including anchor tags. Because Canarytokens does not strip or escape this markup, attacker-supplied input flows directly into the rendered message. Recipients then see content that appears to originate from a trusted Canarytokens alert.
The practical effect is interface manipulation. An attacker who interacts with a token in a way that places controlled data in the alert payload can inject clickable links and formatted text. These elements can mimic legitimate alert components or redirect responders to attacker-controlled destinations.
Root Cause
The root cause is improper output encoding when constructing Google Chat webhook payloads. Fields populated from request data are concatenated into the message without HTML sanitization, satisfying the conditions for [CWE-74].
Attack Vector
The attack is network-based and requires user interaction by the alert recipient, who must view the manipulated Google Chat message. No authentication is required to trigger a canary token. An attacker probes or interacts with a deployed canary, supplying crafted input in fields propagated to the notification. The malicious HTML reaches defenders through the Google Chat channel rather than the Canarytokens web interface itself.
For technical details, refer to the GitHub Security Advisory GHSA-vcfc-7466-8q65.
Detection Methods for CVE-2026-12888
Indicators of Compromise
- Google Chat alert messages from Canarytokens containing unexpected hyperlinks or anchor tags pointing to unfamiliar domains.
- Canarytokens alert content with HTML formatting that does not match standard Canarytokens notification templates.
- Alert fields containing markup characters such as <a href=, <b>, or <i> in user-controllable inputs.
Detection Strategies
- Inspect outbound webhook payloads from Canarytokens instances for HTML tags in fields sourced from token interactions.
- Compare deployed Canarytokens Docker image digests against the fixed tag sha-8ab4dccd or later.
- Review Git commit history of self-hosted deployments to confirm presence of commit 8ab4dccd or later.
Monitoring Recommendations
- Log and review all Google Chat webhook deliveries originating from Canarytokens for anomalous link destinations.
- Alert security responders to treat embedded links in canary notifications as untrusted until the patch is applied.
- Track the Canarytokens release channel for further advisories from Thinkst Applied Research.
How to Mitigate CVE-2026-12888
Immediate Actions Required
- Upgrade Canarytokens to Docker tag sha-8ab4dccd or later, or Git commit 8ab4dccd or later.
- Instruct alert recipients not to click links inside Google Chat canary notifications until the upgrade is verified.
- Audit existing Google Chat alert history for previously delivered injected content.
Patch Information
Thinkst Applied Research released a fix in commit 8ab4dccd, available in the corresponding Docker image tag sha-8ab4dccd. Refer to the GitHub Security Advisory GHSA-vcfc-7466-8q65 for full remediation guidance.
Workarounds
- Disable the Google Chat webhook notification channel and rely on email or other alerting paths until upgraded.
- Route Canarytokens notifications through an intermediary that strips HTML before forwarding to Google Chat.
- Restrict the webhook recipient channel membership so that injected links cannot reach broad audiences.
# Configuration example: pull the patched Canarytokens image
docker pull thinkst/canarytokens:sha-8ab4dccd
docker tag thinkst/canarytokens:sha-8ab4dccd canarytokens:current
docker compose down && docker compose up -d
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
