CVE-2026-46431: Algernon Web Server CSRF Vulnerability

CVE-2026-46431 Overview

CVE-2026-46431 affects Algernon, a self-contained pure-Go web server. The Server-Sent Events (SSE) endpoint hardcodes the Access-Control-Allow-Origin response header to the wildcard * regardless of the requesting origin. Any third-party page a developer visits can open a cross-origin EventSource connection to the SSE port and read the live filename stream from JavaScript. The flaw is categorized under [CWE-942] Permissive Cross-domain Policy with Untrusted Domains. Algernon version 1.17.7 resolves the issue.

Critical Impact
Attackers can host a malicious page that silently reads the SSE filename stream from a developer's local Algernon instance, leaking project file paths and activity.

Affected Products

Algernon web server versions prior to 1.17.7
Algernon SSE event server component
Development environments exposing the SSE port to the browser

Discovery Timeline

2026-05-26 - CVE-2026-46431 published to the National Vulnerability Database
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-46431

Vulnerability Analysis

Algernon ships a Server-Sent Events server that streams live filename updates to connected browser clients. The SSE handler emits Access-Control-Allow-Origin: * on every response, ignoring the value of the request Origin header. Browsers treat the wildcard as authorization for any web origin to read the response body using the EventSource API.

The EventSource interface does not perform a Cross-Origin Resource Sharing (CORS) preflight and does not transmit cookies by default. The wildcard alone is sufficient for cross-origin reads because the request carries no credentials that would require the stricter same-origin rules. A page loaded from an attacker-controlled domain can therefore subscribe to the local Algernon SSE port and receive the live filename stream.

The leaked stream exposes file paths and edit activity within the developer's project. This reveals directory structures, naming conventions, and work-in-progress files that should remain local.

Root Cause

The SSE handler statically writes the wildcard CORS header rather than echoing a validated origin from an allow-list. There is no Origin verification, no token-based authentication, and no binding to localhost-only origins.

Attack Vector

A developer running Algernon locally visits a third-party page containing JavaScript that instantiates new EventSource('http://localhost:<port>/sse'). The browser opens the cross-origin connection, the wildcard header authorizes the read, and the attacker page streams filename events back to a remote collector. User interaction is required only insofar as the victim must load the attacker page.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-hw27-4v2q-5qff for upstream technical details.

Detection Methods for CVE-2026-46431

Indicators of Compromise

Outbound EventSource or long-lived HTTP GET connections from a browser to a local Algernon SSE port originating after navigation to an untrusted site
HTTP responses from Algernon containing Access-Control-Allow-Origin: * on SSE endpoints when the request Origin is not the expected developer host
Algernon process logs showing SSE subscribers with Referer or Origin headers from unfamiliar third-party domains

Detection Strategies

Inspect HTTP response headers on SSE routes and alert on wildcard CORS values served alongside Content-Type: text/event-stream
Correlate browser process telemetry with local socket connections to the Algernon listening port to surface unexpected cross-origin subscriptions
Run software composition analysis to flag Algernon binaries with versions earlier than 1.17.7 in developer workstations and build images

Monitoring Recommendations

Capture and review web proxy logs for connections to development server ports following navigation to external domains
Enable verbose logging on Algernon and forward request metadata, including Origin and Referer, to a centralized log store
Track installed Algernon versions across endpoints and alert when vulnerable builds appear

How to Mitigate CVE-2026-46431

Immediate Actions Required

Upgrade Algernon to version 1.17.7 or later on all developer workstations, CI runners, and demo hosts
Bind Algernon to 127.0.0.1 only when used for local development to reduce network exposure
Restrict outbound browser navigation from hosts running Algernon during active development sessions

Patch Information

The maintainers fixed CVE-2026-46431 in Algernon 1.17.7. The patch removes the hardcoded wildcard and applies an origin-aware CORS policy on the SSE endpoint. Refer to the GitHub Security Advisory GHSA-hw27-4v2q-5qff for the full advisory and fix commit.

Workarounds

Run Algernon behind a reverse proxy that rewrites Access-Control-Allow-Origin to an explicit allow-list of trusted origins
Block external access to the SSE port using host firewall rules limiting connections to loopback interfaces
Disable the SSE event server feature if filename streaming is not required for the workflow

bash

# Configuration example: restrict Algernon to loopback and upgrade
algernon --version              # verify current version
go install github.com/xyproto/algernon@v1.17.7
algernon --addr 127.0.0.1:3000  # bind to loopback only