CVE-2026-13140 Overview
CVE-2026-13140 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Thinkst Applied Research Canarytokens, affecting the exposed AWS API key store component. The flaw allows an authenticated attacker with low privileges to inject persistent script payloads that execute in the browser context of users who view the affected token data. Anonymous exploitation is constrained because it requires prior knowledge of a random identifier, which limits opportunistic attacks. The issue affects Canarytokens from Docker tag sha-4116b92cb before sha-f5aa5c4e, and from Git commit 4116b92cb before f5aa5c4e.
Critical Impact
Successful exploitation enables script execution in the context of legitimate Canarytokens users viewing the AWS API key store, potentially leading to limited disclosure of confidentiality and integrity-impacting actions.
Affected Products
- Thinkst Applied Research Canarytokens (Docker tag sha-4116b92cb through versions before sha-f5aa5c4e)
- Thinkst Applied Research Canarytokens (Git commit 4116b92cb through commits before f5aa5c4e)
- AWS API key store component within Canarytokens
Discovery Timeline
- 2026-06-24 - CVE-2026-13140 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-13140
Vulnerability Analysis
The vulnerability is a stored XSS issue residing in the exposed AWS API key store within the Canarytokens application. Stored XSS occurs when user-controlled input is persisted by the server and later rendered to other users without adequate sanitization or output encoding. In this case, an attacker who can write to fields associated with an AWS API key token can embed JavaScript that executes when another user views the stored data through the web interface. Exploitation requires low-level privileges, user interaction from the victim, and knowledge of a random identifier, which raises the practical attack complexity. The classification under [CWE-79] reflects the absence of correct neutralization of input during web page generation. The current EPSS probability is 0.185%, placing it in the 8.302 percentile.
Root Cause
The root cause is insufficient output encoding or input sanitization in the rendering path for AWS API key token metadata. Data supplied to the store is reflected back into HTML responses without being safely escaped, allowing inline script content to be interpreted by the browser.
Attack Vector
An attacker with low-privilege access submits a malicious payload to a field associated with the AWS API key Canarytoken. The payload persists in the backend store. When an authorized user later opens the affected resource, the browser executes the attacker-supplied script in the user's session context. Anonymous exploitation additionally requires the attacker to know a random identifier tied to the token, which limits scalability of the attack.
No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-23pf-xjp2-48q6 for additional technical detail.
Detection Methods for CVE-2026-13140
Indicators of Compromise
- Unexpected <script> tags, event handler attributes, or encoded JavaScript strings stored within Canarytokens AWS API key token records.
- Outbound HTTP requests from analyst browsers to unfamiliar domains immediately after viewing token management pages.
- Anomalous session activity or token modifications originating from accounts that recently rendered AWS API key token data.
Detection Strategies
- Inspect Canarytokens database entries and rendered HTML responses for script-like content in fields tied to AWS API key tokens.
- Review reverse proxy and web server logs for POST or PUT requests carrying HTML or JavaScript fragments to token creation or update endpoints.
- Correlate browser-side errors, Content Security Policy violations, and unexpected DOM modifications observed by users of the Canarytokens console.
Monitoring Recommendations
- Enable Content Security Policy reporting and forward violation reports to a central log store for review.
- Monitor the thinkst/canarytokens container image for the Docker tag transition from sha-4116b92cb to sha-f5aa5c4e to confirm patched deployments.
- Audit access logs for repeated reads of the same AWS API key token resource by multiple user accounts, which may indicate payload activation.
How to Mitigate CVE-2026-13140
Immediate Actions Required
- Upgrade Canarytokens to Docker tag sha-f5aa5c4e or later, or Git commit f5aa5c4e or later.
- Audit existing AWS API key tokens for stored payloads containing HTML or JavaScript content and purge any suspicious entries.
- Restrict console access to trusted administrators and rotate any credentials that may have been exposed through a victim browser session.
Patch Information
Thinkst has released a fix in Canarytokens commit f5aa5c4e, distributed in the Docker image tagged sha-f5aa5c4e. Details are documented in the GitHub Security Advisory GHSA-23pf-xjp2-48q6. Operators should pull the updated container image and redeploy the service.
Workarounds
- Limit who can create or modify AWS API key Canarytokens until the patched version is deployed.
- Apply a strict Content Security Policy that disallows inline scripts on the Canarytokens web interface.
- Treat the random identifier associated with each token as a secret and avoid sharing it through untrusted channels.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
