CVE-2026-76803: Nuclei Vulnerability Scanner Auth Bypass

CVE-2026-76803 Overview

CVE-2026-76803 affects Nuclei, a widely deployed vulnerability scanner built on a YAML-based domain-specific language (DSL). The flaw resides in the nuclei/mysql JavaScript library, which fails to enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL Data Source Name (DSN) option. An untrusted javascript: template pointed at an attacker-controlled MySQL-compatible endpoint can trigger LOAD DATA LOCAL INFILE requests. The scanner's MySQL client then reads arbitrary files and returns their contents to the server, even when -allow-local-file-access is disabled.

Critical Impact
Attackers can exfiltrate arbitrary files from systems running Nuclei versions 3.0.0 through 3.9.x by supplying a malicious JavaScript template, since these templates run unsigned and without the -code flag on affected releases.

Affected Products

ProjectDiscovery Nuclei 3.0.0 through 3.9.x (CLI deployments)
ProjectDiscovery Nuclei SDK integrations that accept untrusted templates
Nuclei nuclei/mysql JavaScript library component

Discovery Timeline

2026-09-22 - CVE-2026-76803 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database
v3.10.0 - ProjectDiscovery released the patched version resolving the sandbox bypass

Technical Details for CVE-2026-76803

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. Nuclei's MySQL protocol library exposes a JavaScript-accessible interface that accepts arbitrary DSN parameters, including allowAllFiles=true. The Go MySQL driver honors this option and permits the server to request local files via LOAD DATA LOCAL INFILE. Nuclei's -allow-local-file-access (also known as -lfa) command-line flag is intended to gate local file interactions, but the MySQL library never consulted this flag before establishing the connection.

An attacker who can deliver a malicious template to a Nuclei operator, or who controls a MySQL endpoint that a Nuclei scan targets, can read any file readable by the scanning process. This includes SSH keys, cloud credentials, configuration files, and application secrets. Because JavaScript templates in the affected versions run unsigned and without requiring the -code flag, exploitation does not require a template author signature or elevated CLI options.

Root Cause

The root cause is a missing enforcement check in pkg/js/libs/mysql/mysql.go and pkg/js/libs/mysql/mysql_private.go. The DSN parsing path allowed allowAllFiles to propagate to the underlying go-sql-driver/mysql client without validating that the operator had opted into local file access. The sandbox intended to prevent file disclosure was bypassable purely through DSN configuration supplied by a template.

Attack Vector

Exploitation requires user interaction: an operator must run a malicious javascript: template or scan an attacker-controlled MySQL-compatible endpoint. Once the connection is established with allowAllFiles=true, the malicious server responds to the client's queries with LOAD DATA LOCAL INFILE <path> packets. The Nuclei MySQL client dutifully opens the specified path and streams its contents back to the server.

// Patch excerpt from pkg/js/libs/mysql/mysql_private.go
// Source: https://github.com/projectdiscovery/nuclei/commit/9611926a9a1ca99e8ed554d1b26fbeff60e06368

	"net"
	"net/url"
	"strings"

	"github.com/go-sql-driver/mysql"
	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate"
	"github.com/projectdiscovery/nuclei/v3/pkg/types"
)

The patch introduces imports for protocolstate and types so the MySQL library can consult the runtime option state and reject allowAllFiles unless -lfa is enabled. See the GitHub commit and Pull Request #7473 for the full diff.

Detection Methods for CVE-2026-76803

Indicators of Compromise

Outbound MySQL connections (TCP/3306 or non-standard ports) from Nuclei scanner hosts to unexpected external endpoints
Presence of allowAllFiles=true substrings in template files, command-line history, or Nuclei logs
Unexpected reads of sensitive files such as /etc/passwd, ~/.ssh/id_rsa, or cloud credential paths by the Nuclei process
JavaScript templates with mysql protocol references sourced from untrusted repositories

Detection Strategies

Inventory all hosts running Nuclei and identify versions between 3.0.0 and 3.9.x
Audit template repositories and CI/CD pipelines for javascript: templates invoking the mysql library
Deploy network monitoring rules to alert on MySQL protocol traffic originating from scanning infrastructure toward non-approved destinations
Review process telemetry for the Nuclei binary opening files unrelated to its working directory

Monitoring Recommendations

Enable file access auditing on scanner hosts covering credential stores, SSH directories, and application configuration paths
Forward Nuclei execution logs and command-line arguments to a central logging platform for retrospective analysis
Alert on any Nuclei invocation that passes untrusted or externally sourced template files

How to Mitigate CVE-2026-76803

Immediate Actions Required

Upgrade all Nuclei installations to version 3.10.0 or later without delay
Revoke and rotate any credentials, tokens, or keys that were accessible to the scanner account during the exposure window
Restrict Nuclei execution to trusted, signed templates only and disable execution of unsigned javascript: templates
Run Nuclei under a least-privilege service account with no access to sensitive files

Patch Information

ProjectDiscovery resolved CVE-2026-76803 in Nuclei Release v3.10.0. The fix gates the MySQL allowAllFiles DSN option behind the existing -lfa (allow-local-file-access) flag. Additional context is available in the GitHub Security Advisory GHSA-xhmx-w2j4-rw3q.

Workarounds

Do not process templates from untrusted sources on unpatched Nuclei versions
Explicitly avoid the -allow-local-file-access / -lfa flag on unpatched installations
Egress-filter scanner hosts so they cannot connect to attacker-controlled MySQL endpoints
Isolate scanning infrastructure in a dedicated network segment without access to secret stores

bash

# Upgrade Nuclei to the patched release
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.10.0

# Verify the installed version
nuclei -version

# Run scans without granting local file access
nuclei -t templates/ -u https://target.example.com