CVE-2026-31309: Mysterium Node Auth Bypass Vulnerability

CVE-2026-31309 Overview

CVE-2026-31309 is an improper authorization vulnerability in the /tequilapi/config/user endpoint of Mysterium Node before version 1.36.0. The endpoint was included in the list of unprotected routes, allowing unauthenticated attackers to send crafted POST requests that overwrite the node's configuration. Successful exploitation results in a full node takeover because an attacker can rewrite arbitrary configuration values consumed by the node runtime.

Critical Impact
Unauthenticated attackers reachable over the Tequilapi interface can arbitrarily modify node configuration and achieve complete node takeover.

Affected Products

Mysterium Node versions before 1.36.0
Mysterium Node 1.35.5 (confirmed vulnerable via referenced source)
Mobile provider builds where TequilapiSecured defaulted to false

Discovery Timeline

2026-07-08 - CVE-2026-31309 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-31309

Vulnerability Analysis

Mysterium Node exposes a local HTTP API called Tequilapi. The routing layer defines a list of UnprotectedRoutes that bypass reverse-proxy authentication. In vulnerable releases, /config/user was included in that whitelist, so any client able to reach the Tequilapi port could issue a POST request to /tequilapi/config/user and rewrite persistent node settings without providing credentials.

Because node configuration governs identity, payment, and network behavior, arbitrary write access to this endpoint is equivalent to full control of the node. On mobile provider builds the risk was amplified: DefaultProviderNodeOptions shipped with TequilapiSecured = false, meaning the Tequilapi listener was not fronted by the authenticating reverse proxy at all.

Root Cause

The defect is a broken access control decision in tequilapi/tequil/routes.go. The /config/user path was listed in UnprotectedRoutes alongside routes intentionally exposed pre-authentication such as /auth/login and /healthcheck. Configuration write operations should require an authenticated session, but the whitelist entry caused IsUnprotectedRoute to return true for configuration mutations.

Attack Vector

An attacker with network reachability to the Tequilapi listener sends a POST request to /tequilapi/config/user containing a JSON body of configuration keys and values. The request bypasses the reverse proxy's authentication check because of the whitelist entry, and the handler applies the supplied values via SetConfig. The attacker can then pivot to identity theft, traffic redirection, or persistent control of the node.

// Patch: tequilapi/tequil/routes.go
const TequilapiURLPrefix = "/tequilapi"

// UnprotectedRoutes these routes are not protected by reverse proxy
-var UnprotectedRoutes = []string{"/auth/authenticate", "/auth/login", "/healthcheck", "/config/user", "/config/ui/features"}
+var UnprotectedRoutes = []string{"/auth/authenticate", "/auth/login", "/healthcheck", "/config/ui/features"}

// IsUnprotectedRoute helper method for checking if route is unprotected
func IsUnprotectedRoute(url string) bool {

Source: Mysterium Node commit bc099fc

// Patch: mobile/mysterium/mobile_provider.go
func DefaultProviderNodeOptions() *MobileNodeOptions {
    options := DefaultNodeOptionsByNetwork(string(config.Mainnet))
    options.IsProvider = true
-   options.TequilapiSecured = false
+   options.TequilapiSecured = true
    return options
}

Source: Mysterium Node commit 8305119

Detection Methods for CVE-2026-31309

Indicators of Compromise

Unauthenticated POST requests to /tequilapi/config/user in Tequilapi access logs
Unexpected changes to node configuration values (identity, payout address, network settings) without a preceding authenticated session
Tequilapi listeners bound to non-loopback interfaces on Mysterium Node versions earlier than 1.36.0

Detection Strategies

Inspect HTTP access logs for POST verbs against /tequilapi/config/user and correlate with the absence of a prior /auth/login or /auth/authenticate request from the same client.
Compare current node configuration against a known-good baseline and flag drift, particularly in identity and payment-related keys.
Audit deployed Mysterium Node binaries and flag any version below 1.36.0, as noted in the 1.36.0 release notes.

Monitoring Recommendations

Alert on any inbound connections to the Tequilapi port (default 4050) originating from outside 127.0.0.1.
Monitor process behavior for configuration file writes triggered by the node process shortly after external HTTP traffic to the Tequilapi endpoint.
Capture and retain Tequilapi request logs so that unauthenticated configuration writes can be reconstructed during incident response.

How to Mitigate CVE-2026-31309

Immediate Actions Required

Upgrade Mysterium Node to version 1.36.0 or later using the 1.36.0 release.
Restrict Tequilapi exposure to 127.0.0.1 and block external access to TCP 4050 at the host or network firewall.
Rotate node identity credentials and payout configuration on any node that ran a vulnerable version with a network-exposed Tequilapi.

Patch Information

The fix removes /config/user from the UnprotectedRoutes list in tequilapi/tequil/routes.go so that configuration writes require authentication through the reverse proxy. A companion change in mobile/mysterium/mobile_provider.go sets TequilapiSecured = true by default for mobile provider builds. Both changes are included in Mysterium Node 1.36.0. See the routes.go patch commit and the mobile provider patch commit for the exact diffs.

Workarounds

Bind the Tequilapi listener to loopback only and place authenticated tunnels or SSH port forwarding in front of any remote administration.
Enforce host firewall rules that drop inbound traffic to Tequilapi ports from untrusted networks until the patched release is deployed.
Disable the Tequilapi interface on provider nodes that do not require it, following guidance in the Mysterium Node repository.

bash

# Restrict Tequilapi to loopback using iptables
iptables -A INPUT -p tcp --dport 4050 ! -s 127.0.0.1 -j DROP

# Verify running node version
myst --version