CVE-2026-45577: Neotoma Auth Bypass Vulnerability

CVE-2026-45577 Overview

CVE-2026-45577 is an authentication bypass vulnerability in Neotoma, a tool that provides versioned records persisting across agent runs. The flaw exists in versions 0.6.0 through 0.11.0. Neotoma treats public reverse-proxied requests as local when the application receives them over a loopback socket without a Bearer token. The REST authentication middleware resolves unauthenticated requests as the local development user. This grants access to the hosted Inspector and related API surface without credentials. The issue is tracked under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Unauthenticated network attackers can reach the Inspector and REST API surface of Neotoma deployments fronted by a reverse proxy, gaining the privileges of the local development user.

Affected Products

Neotoma versions 0.6.0 through 0.11.0
Deployments where Neotoma is exposed via a reverse proxy that forwards traffic over loopback
REST authentication middleware and hosted Inspector component

Discovery Timeline

2026-05-29 - CVE-2026-45577 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45577

Vulnerability Analysis

Neotoma's REST authentication middleware uses socket-level trust to determine request locality. When the middleware observes a connection arriving on a loopback interface and no Bearer token is supplied, it classifies the caller as the local development user. The middleware then short-circuits authentication and forwards the request to protected handlers.

This logic ignores the upstream context. Reverse proxies typically terminate external client connections and re-issue them to the backend over 127.0.0.1 or a Unix domain socket. The middleware cannot distinguish a genuine local operator from a remote client whose request was proxied through the loopback interface. The result is a network-reachable authentication bypass that exposes the hosted Inspector and API endpoints.

Root Cause

The vulnerability stems from conflating transport-layer locality with caller identity. The middleware treats the loopback socket as a security boundary, but reverse-proxied deployments place untrusted clients on the same socket. Bearer token enforcement is skipped under the assumption that any loopback caller is privileged.

Attack Vector

An attacker sends an unauthenticated HTTP request to a Neotoma instance fronted by a reverse proxy. The proxy forwards the request to Neotoma over loopback. Neotoma omits the Authorization: Bearer header check and serves the response with local development user privileges. The attacker can then enumerate or interact with the Inspector and REST endpoints.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-5cvp-p7p4-mcx9 for additional technical context.

Detection Methods for CVE-2026-45577

Indicators of Compromise

Successful HTTP responses from Inspector or REST endpoints lacking an Authorization header in proxy access logs
Unexpected requests to internal Neotoma API paths originating from external client IPs in upstream proxy logs
Inspector activity recorded outside expected developer working hours or from non-developer source addresses

Detection Strategies

Correlate reverse proxy access logs with Neotoma application logs to identify unauthenticated requests resolved as the local user
Audit Neotoma deployments for versions between 0.6.0 and 0.11.0 using package inventory data
Alert on requests to Inspector routes that lack a Bearer token but receive a 200 OK response

Monitoring Recommendations

Capture upstream client IPs via X-Forwarded-For and log them alongside Neotoma authentication decisions
Monitor for spikes in anonymous traffic reaching Neotoma-protected paths after deployment changes
Track outbound data volume from Inspector endpoints to identify reconnaissance or scraping activity

How to Mitigate CVE-2026-45577

Immediate Actions Required

Upgrade Neotoma to version 0.11.1 or later, which contains the fix for this vulnerability
Restrict reverse proxy configurations so that public traffic cannot reach Neotoma without authentication enforcement at the proxy layer
Disable or firewall the hosted Inspector on production deployments until patching is complete

Patch Information

The vendor released the fix in Neotoma v0.11.1. The patched middleware no longer treats loopback-origin requests as implicitly authenticated. Refer to the GitHub Security Advisory GHSA-5cvp-p7p4-mcx9 for full remediation details.

Workarounds

Require a Bearer token on all reverse proxy routes that forward to Neotoma, rejecting requests without credentials before they reach the loopback socket
Bind Neotoma exclusively to a Unix socket accessible only to trusted local processes when a reverse proxy is not in use
Enforce network-level access controls limiting Inspector reachability to administrator IP ranges

bash

# Example nginx snippet to require Authorization header before proxying to Neotoma
location /neotoma/ {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://127.0.0.1:8080/;
    proxy_set_header Authorization $http_authorization;
    proxy_set_header X-Forwarded-For $remote_addr;
}