CVE-2026-79574: mpush Gateway Server RCE Vulnerability

CVE-2026-79574 Overview

CVE-2026-79574 is a remote code execution vulnerability in the gateway server component of mpush v0.8.1, an open-source message push service. Attackers can execute arbitrary code on the target system by sending a specially crafted broadcast message to the gateway. The flaw is classified under [CWE-94] Improper Control of Generation of Code (Code Injection). No authentication or user interaction is required for exploitation, and the attack can be launched remotely across the network.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary code execution on the mpush gateway server, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

mpush v0.8.1 gateway server

Discovery Timeline

2026-09-08 - CVE-2026-79574 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79574

Vulnerability Analysis

The vulnerability resides in the gateway server component of mpush v0.8.1, which processes broadcast messages distributed across the push infrastructure. When the gateway parses a crafted broadcast payload, it fails to properly restrict how message contents are evaluated. This allows attacker-controlled data to be interpreted as executable code by the server process.

Because mpush gateway servers typically operate as long-running network services exposed to internal push producers or, in misconfigured deployments, to broader networks, the flaw provides a direct path from message ingestion to code execution. A successful exploit yields the privileges of the mpush service account, which can be leveraged for lateral movement, credential theft, or persistence within the push messaging tier.

Root Cause

The root cause is a code injection weakness [CWE-94] in the broadcast message handler. The gateway processes untrusted broadcast content in a code-generation or dynamic-evaluation context without adequate validation or sandboxing. Attacker-supplied fields in the broadcast message flow into an evaluation sink, causing the runtime to execute injected instructions.

Attack Vector

Exploitation occurs over the network with low attack complexity and no privileges required. An attacker who can send a broadcast message to the mpush gateway crafts the message so that its contents include an injection payload targeting the vulnerable handler. Upon receipt, the gateway processes the payload and executes the embedded code. Additional details are documented in the GitHub RCE Exploit Document.

Detection Methods for CVE-2026-79574

Indicators of Compromise

Unexpected child processes spawned by the mpush gateway server process, particularly shells or scripting interpreters.
Anomalous outbound network connections originating from the mpush gateway host to unfamiliar destinations.
Broadcast messages containing script fragments, serialized payloads, or unusual control characters in message body fields.
New or modified files in the mpush installation directory or service user home directory following broadcast traffic spikes.

Detection Strategies

Inspect application logs on the mpush gateway for parsing errors, evaluation exceptions, or stack traces tied to broadcast message handling.
Correlate inbound broadcast traffic with process creation events on the gateway host to identify message-triggered execution.
Deploy network signatures that flag broadcast payloads containing common code-injection primitives targeting the mpush protocol.

Monitoring Recommendations

Enable process-execution telemetry on all hosts running mpush v0.8.1 and alert on non-standard child processes of the gateway service.
Monitor mpush gateway network exposure and alert on new client sources sending broadcast messages from outside expected producer ranges.
Track file integrity in mpush binary and configuration directories to detect post-exploitation persistence.

How to Mitigate CVE-2026-79574

Immediate Actions Required

Restrict network access to the mpush gateway server so that only trusted producer hosts can submit broadcast messages, using firewall rules or service mesh policies.
Audit deployed mpush instances to identify any version 0.8.1 gateways and treat them as high-priority remediation targets.
Review recent broadcast message logs for anomalous payloads and investigate corresponding gateway hosts for signs of compromise.

Patch Information

No vendor patch information is referenced in the enriched CVE data. Consult the mpush project repository for the latest maintained release and apply any fixed version once available. Until a patch is confirmed, treat v0.8.1 deployments as vulnerable.

Workarounds

Isolate mpush gateway servers on a dedicated network segment reachable only by authenticated internal producers.
Enforce authentication and authorization at a network proxy in front of the gateway to reject untrusted broadcast senders.
Run the mpush gateway process under a low-privileged service account with restricted filesystem and network capabilities to limit blast radius.
Disable or filter broadcast message functionality at the application layer if it is not required by the deployment.

bash

# Example: restrict mpush gateway access to trusted producer subnet using iptables
iptables -A INPUT -p tcp --dport 3000 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP