CVE-2026-57952: Mythic Authorization Bypass Vulnerability

CVE-2026-57952 Overview

CVE-2026-57952 is an authorization bypass vulnerability in Mythic, an open-source command-and-control (C2) framework maintained by its-a-feature. Versions before 3.4.0.60 fail to verify payload ownership across four REST endpoints: c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, and c2profile_sample_message_webhook. An authenticated operator assigned to one operation can supply a payload UUID belonging to a different operation and retrieve that operation's C2 profile configuration. The exposed data includes encryption keys and callback parameters, breaking the multi-tenant isolation model that Mythic enforces between operations. The weakness is tracked as CWE-862: Missing Authorization.

Critical Impact
Any authenticated Mythic operator can read another operation's C2 profile configuration, including encryption keys and callback endpoints, if a payload UUID from that operation is known or guessed.

Affected Products

Its-a-feature Mythic versions prior to 3.4.0.60
Endpoint c2profile_config_check_webhook
Endpoints c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook

Discovery Timeline

2026-06-29 - CVE-2026-57952 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57952

Vulnerability Analysis

Mythic separates work into operations, and operators are scoped to the operations they belong to. The four affected webhook controllers accept a PayloadUUID in the request body and use it to look up the associated payload row in the database. The controllers execute a lookup on the payload table using only the UUID as a filter, without joining against the current operator's active operation. Because payload UUIDs are the sole authorization boundary, any operator who obtains a UUID from another operation can pivot the request to that operation's data. The response returns C2 profile parameter instances, which contain the encryption keys, callback hosts, callback intervals, and other sensitive C2 configuration attributes needed to interact with implants.

Root Cause

The root cause is a missing tenancy check in the SQL query used to resolve a payload. The pre-patch query filtered only on uuid, meaning the database returned any matching payload regardless of which operation owned it. There was no verification that the caller's current operation matched the payload's operation_id before returning C2 profile parameter instances.

Attack Vector

Exploitation requires network access to the Mythic web server and valid operator credentials. The attacker submits a crafted POST request to one of the four affected endpoints containing a known payload UUID from a target operation. UUIDs may be obtained through prior collaboration on shared servers, shoulder surfing, log exposure, or brute forcing if UUIDs are exposed. The server returns the target operation's C2 profile configuration without any cross-operation authorization check.

// Patch: mythic-docker/src/webserver/controllers/c2profile_config_check_webhook.go
// Adds current-operation lookup and enforces operation_id in the payload query.

		})
		return
	}
+	ginOperatorOperation, ok := c.Get("operatorOperation")
+	if !ok {
+		logging.LogError(nil, "Failed to get operatorOperation information for CreateC2ParameterInstanceWebhook")
+		c.JSON(http.StatusOK, gin.H{"status": "error", "error": "Failed to get current operation. Is it set?"})
+		return
+	}
+	operatorOperation := ginOperatorOperation.(*databaseStructs.Operatoroperation)
	// get the associated database information
	payload := databaseStructs.Payload{}
-	if err := database.DB.Get(&payload, `SELECT id FROM payload WHERE uuid=$1`, input.Input.PayloadUUID); err != nil {
+	if err := database.DB.Get(&payload, `SELECT id FROM payload WHERE uuid=$1 AND operation_id=$2`, input.Input.PayloadUUID, operatorOperation.CurrentOperation.ID); err != nil {
		logging.LogError(err, "Failed to find payload when doing a C2ProfileConfigCheckWebhook")
	}
	c2profileParameterInstances := []databaseStructs.C2profileparametersinstance{}

Source: GitHub commit 82648e8 — the fix retrieves the caller's current operation from the Gin context and adds AND operation_id=$2 to the payload lookup, ensuring the payload belongs to the operator's active operation before returning C2 profile data.

Detection Methods for CVE-2026-57952

Indicators of Compromise

POST requests to /api/v*/c2profile_config_check_webhook, /api/v*/c2profile_redirect_rules_webhook, /api/v*/c2profile_get_ioc_webhook, or /api/v*/c2profile_sample_message_webhook containing payload UUIDs not associated with the requesting operator's operation.
Mythic application logs showing repeated Failed to find payload errors, which can indicate UUID enumeration attempts against these endpoints.
Operator sessions accessing C2 profile configuration data for payloads created by other operations.

Detection Strategies

Correlate the operator_id on inbound webhook requests with the operation_id of the payload UUID in the request body. Any mismatch is a signal of attempted cross-operation access.
Enable verbose Mythic web server logging and monitor for unusually high request volumes to the four affected webhook routes.
Review database audit logs for SELECT queries against the payload table that resolve to rows outside the caller's operation.

Monitoring Recommendations

Ingest Mythic web server and container logs into a centralized log platform and alert on webhook errors referencing missing payloads.
Track operator activity on a per-operation basis and flag any operator that queries payload UUIDs across multiple operations within a short time window.
Monitor for changes to C2 profile configuration reads immediately followed by new implant callbacks from unexpected sources.

How to Mitigate CVE-2026-57952

Immediate Actions Required

Upgrade Mythic to version 3.4.0.60 or later, which enforces operation_id checks on all four affected webhooks.
Rotate any C2 profile encryption keys and callback secrets that may have been exposed on shared Mythic instances prior to patching.
Audit operator accounts and remove access for any operator who does not require it.

Patch Information

The vendor released the fix in Mythic v3.4.0.60. The corrective change is in commit 82648e8, which adds an operatorOperation context lookup and enforces AND operation_id=$2 on the payload SQL query in each affected webhook controller. Additional context is available in the GitHub issue #564 and the VulnCheck advisory.

Workarounds

Restrict Mythic web server access to trusted networks or VPNs so that only vetted operators can reach the affected endpoints.
On multi-tenant Mythic servers, isolate teams onto separate Mythic deployments until the patch is applied.
Regenerate payload UUIDs and rebuild affected payloads after upgrading to invalidate any UUIDs that may have leaked between operations.

bash

# Upgrade Mythic to the patched release
cd /path/to/Mythic
git fetch --tags
git checkout v3.4.0.60
sudo ./mythic-cli stop
sudo ./mythic-cli start

# Verify the running version
sudo ./mythic-cli version