CVE-2026-85636 Overview
CVE-2026-85636 is a missing authentication vulnerability [CWE-287] affecting jofpin trape version 1.0.0. The flaw resides in an unknown function within the core/stats.py file, which implements the Login Endpoint component. Remote attackers can manipulate this endpoint without providing credentials, bypassing authentication controls that should protect the affected functionality. The exploit is publicly disclosed and may be used against exposed instances. According to the advisory, the project maintainers were notified through an issue report but have not responded.
Critical Impact
Unauthenticated remote attackers can access protected functionality in the trape Login Endpoint, exposing confidentiality of application data.
Affected Products
- jofpin trape 1.0.0
- Component: Login Endpoint (core/stats.py)
- Deployments exposing the trape web interface to untrusted networks
Discovery Timeline
- 2026-09-04 - CVE-2026-85636 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85636
Vulnerability Analysis
The vulnerability affects trape, an open-source people tracking and analysis tool maintained on GitHub. The defect lies in unspecified functionality of core/stats.py, which is part of the Login Endpoint. Because required authentication checks are missing, requests reach protected handlers without credential validation.
An attacker can invoke the endpoint over the network without prior authentication or user interaction. Successful exploitation grants access to functionality that the application intends to restrict to authenticated sessions. Public disclosure of the exploit lowers the barrier for opportunistic attacks against exposed deployments.
Root Cause
The root cause is classified as CWE-287: Improper Authentication. The Login Endpoint handler in core/stats.py does not verify that incoming requests carry a valid authenticated session before executing protected logic. This design gap allows anonymous access to functionality that should require credentials.
Attack Vector
Exploitation occurs remotely over the network with low complexity. Attackers send crafted HTTP requests directly to the exposed Login Endpoint without providing credentials or interacting with a user. No privileges are required prior to the request. The impact is limited to confidentiality of application data reachable through the affected endpoint, as reflected in the CVSS vector.
The vulnerability manifests in the request handling flow of core/stats.py. See the GitHub Trape Issue #405 and the VulDB CVE-2026-85636 entry for additional technical context and references to the public proof of concept.
Detection Methods for CVE-2026-85636
Indicators of Compromise
- Unauthenticated HTTP requests to the trape Login Endpoint paths handled by core/stats.py.
- Access log entries showing successful responses to /stats or related routes from clients without prior session cookies.
- Unexpected outbound requests or data reads originating from the trape process shortly after unauthenticated inbound traffic.
Detection Strategies
- Review reverse proxy and web server logs for requests to the trape stats endpoint that lack session tokens or authentication headers.
- Enable verbose request logging within the trape application to identify anonymous invocations of protected handlers.
- Correlate spikes in requests to the Login Endpoint with source IP reputation feeds to surface opportunistic scans.
Monitoring Recommendations
- Alert on HTTP 200 responses from the trape stats endpoint when the request contains no authenticated session cookie.
- Monitor for repeated requests from a single source IP enumerating trape routes.
- Track process-level network activity for the trape service and flag connections initiated outside normal operational windows.
How to Mitigate CVE-2026-85636
Immediate Actions Required
- Take exposed trape 1.0.0 instances offline or restrict them to trusted networks until a patch is available.
- Place the application behind an authenticating reverse proxy that enforces credentials before requests reach core/stats.py.
- Audit access logs for prior unauthenticated requests to the Login Endpoint and investigate any anomalous access.
Patch Information
No vendor patch is available at the time of publication. According to the advisory, the project was notified through an issue report but has not responded. Monitor the GitHub Trape Project repository and GitHub Trape Issue #405 for updates on a fix.
Workarounds
- Enforce network-level access controls such as firewall rules, VPN gating, or IP allowlists on the trape service.
- Deploy an authenticating reverse proxy (for example, nginx with auth_basic or an OAuth2 proxy) in front of trape to require credentials before requests reach the application.
- Disable or remove the trape deployment if the tool is not actively required, given the absence of a vendor fix.
- Rate-limit requests to the Login Endpoint to reduce the impact of automated exploitation attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
