CVE-2026-57953: Mythic Auth Bypass Vulnerability

CVE-2026-57953 Overview

CVE-2026-57953 is an authorization bypass vulnerability in Mythic, an open-source command and control (C2) framework maintained by its-a-feature. Versions prior to 3.4.0.60 register the eventing_import_automatic_webhook endpoint under spectator-permitted middleware. Authenticated users assigned the spectator role can invoke this endpoint to perform write operations they should not be authorized to execute. Successful exploitation lets an attacker create and delete automation workflows and modify operation automation configuration and EventGroups. The issue is tracked as an authorization flaw under CWE-863: Incorrect Authorization.

Critical Impact
Spectator-role accounts, intended for read-only visibility, can silently alter automation configuration and EventGroups, undermining operational integrity within Mythic deployments.

Affected Products

Its-a-feature Mythic, all versions prior to 3.4.0.60
Mythic server component mythic-docker webserver controllers
Deployments exposing the eventing_import_automatic_webhook endpoint

Discovery Timeline

2026-06-29 - CVE-2026-57953 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57953

Vulnerability Analysis

Mythic uses Gin middleware groups to enforce role-based access control across its HTTP webhook endpoints. The eventing_import_automatic_webhook endpoint was registered under middleware that permits spectator-role users. Spectator accounts are intended to provide read-only visibility into operations, not to modify server state. Because the endpoint performs create and delete operations on automation workflows, the misclassification collapses the boundary between read-only and operator privileges. An attacker holding valid spectator credentials can push crafted requests that mutate operation automation configuration and EventGroups without escalating their nominal role.

Root Cause

The root cause is a middleware registration error rather than a missing check inside business logic. The webhook handler assumed the surrounding middleware would restrict callers to authorized roles, but the endpoint was mounted on a router group that included the spectator role. This is a canonical [CWE-863] Incorrect Authorization pattern: the caller is authenticated, but the server fails to verify the caller is authorized for the requested action. The related patch in mythic-docker/src/webserver/controllers/ also tightens the association between callers and their operatorOperation context, ensuring queries are scoped by operation_id.

Attack Vector

Exploitation requires network access to the Mythic web interface and valid credentials for any spectator-role account. No user interaction is required. The attacker sends an HTTP request to the eventing_import_automatic_webhook endpoint with a payload that creates or deletes an automation workflow. Because the request passes middleware checks and reaches the handler, the modification is persisted and applied to subsequent operation events.

// Patch excerpt from mythic-docker/src/webserver/controllers/c2profile_config_check_webhook.go
// Adds operatorOperation retrieval and scopes payload lookup by operation_id

ginOperatorOperation, ok := c.Get("operatorOperation")
if !ok {
    logging.LogError(nil, "Failed to get operatorOperation information for CreateC2ParameterInstanceWebhook")
    c.JSON(http.StatusOK, gin.H{"status": "error", "error": "Failed to get current operation. Is it set?"})
    return
}
operatorOperation := ginOperatorOperation.(*databaseStructs.Operatoroperation)
// get the associated database information
payload := databaseStructs.Payload{}
if err := database.DB.Get(&payload, `SELECT id FROM payload WHERE uuid=$1 AND operation_id=$2`, input.Input.PayloadUUID, operatorOperation.CurrentOperation.ID); err != nil {
    logging.LogError(err, "Failed to find payload when doing a C2ProfileConfigCheckWebhook")
}

Source: Mythic security commit 82648e8

Detection Methods for CVE-2026-57953

Indicators of Compromise

HTTP requests to /eventing_import_automatic_webhook originating from accounts assigned the spectator role.
Unexpected creation or deletion of EventGroups and automation workflows in Mythic operation logs.
Automation configuration changes not correlated with operator or admin session activity.

Detection Strategies

Review Mythic webserver access logs for POST requests to the eventing_import_automatic_webhook endpoint and correlate them with the caller's role.
Alert on any state-changing API call performed by an account whose assigned role is spectator.
Compare automation workflow inventories against a known-good baseline to identify unauthorized additions or deletions.

Monitoring Recommendations

Forward Mythic container logs to a centralized logging platform and retain them for post-incident review.
Enable audit logging for EventGroup and automation workflow changes, capturing the acting user identifier.
Track authentication events for spectator accounts and flag deviations from expected read-only usage patterns.

How to Mitigate CVE-2026-57953

Immediate Actions Required

Upgrade Mythic to version 3.4.0.60 or later using the release published at Mythic v3.4.0.60.
Audit existing spectator accounts and revoke credentials that are no longer required.
Review automation workflows and EventGroups for unauthorized modifications introduced before patching.

Patch Information

The fix is delivered in Mythic release 3.4.0.60 and implemented by commit 82648e8241b800a32e1882afc310e7316d98ebaa. The patch relocates the affected endpoint out of spectator-permitted middleware and adds explicit operatorOperation context checks so webhook handlers scope database access to the caller's current operation. Additional discussion is available in Mythic issue #565 and the VulnCheck Security Advisory.

Workarounds

Restrict network access to the Mythic web interface to trusted operator hosts using firewall rules or a reverse proxy allowlist.
Temporarily suspend spectator-role accounts until the upgrade to 3.4.0.60 is applied.
Place the Mythic server behind an authenticating reverse proxy that blocks requests to eventing_import_automatic_webhook for non-operator identities.

bash

# Example nginx snippet to block the vulnerable endpoint until patched
location = /eventing_import_automatic_webhook {
    deny all;
    return 403;
}