CVE-2026-85688: TEN Framework Auth Bypass Vulnerability

CVE-2026-85688 Overview

CVE-2026-85688 is an unauthenticated arbitrary file read and write vulnerability in TEN Framework version 0.11.71. The flaw resides in the TMAN Designer file-content API endpoints under /api/designer/v1/file-content. Attackers can issue POST and PUT requests to read arbitrary files from the host or write attacker-controlled content to arbitrary system paths. Successful exploitation enables remote code execution through common Unix persistence mechanisms such as ~/.ssh/authorized_keys, cron files, or executable graph files consumed by the framework. The vulnerability is classified under [CWE-306: Missing Authentication for a Critical Function].

Critical Impact
Unauthenticated network attackers can read sensitive files and overwrite system files, achieving remote code execution on hosts running TEN Framework 0.11.71.

Affected Products

TEN Framework 0.11.71
TMAN Designer component (ten_manager module)
Deployments exposing the designer API to untrusted networks

Discovery Timeline

2026-09-04 - CVE-2026-85688 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85688

Vulnerability Analysis

The TMAN Designer service exposes HTTP endpoints for editing TEN Framework project files. The file-content handler, implemented in core/src/ten_manager/src/designer/file_content/mod.rs, accepts a file path parameter and performs read or write operations directly against the local filesystem. The handler does not enforce authentication, session validation, or path constraints. Any client that can reach the designer listener can invoke the endpoint.

Because the service typically runs with the privileges of the developer or operator who launched it, arbitrary writes translate into code execution. Attackers commonly target ~/.ssh/authorized_keys to obtain interactive SSH access, drop cron entries under /etc/cron.d/, or overwrite .graph files that TEN Framework loads and executes as agent workflows.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The file-content route accepts POST requests to read files and PUT requests to write files without validating caller identity or restricting the target path to a project workspace. Path normalization and allow-listing are also absent, so .. traversal and absolute paths reach the underlying filesystem APIs unmodified.

Attack Vector

Exploitation requires only network reachability to the TMAN Designer HTTP listener. An attacker sends a POST to /api/designer/v1/file-content with a JSON body specifying an absolute path such as /etc/passwd to exfiltrate contents. A follow-up PUT to the same endpoint writes attacker-supplied bytes to any writable path. Chaining a write to authorized_keys with an outbound SSH connection yields full shell access. See the VulnCheck Advisory for TEN Framework and the vulnerable handler source for the request schema and code path.

Detection Methods for CVE-2026-85688

Indicators of Compromise

Unexpected POST or PUT requests to /api/designer/v1/file-content in TMAN Designer access logs
New or modified entries in ~/.ssh/authorized_keys for the account running TMAN Designer
Newly created files under /etc/cron.d/, /etc/cron.hourly/, or user crontabs coinciding with designer activity
Unexpected modifications to TEN Framework .graph project files or extension manifests

Detection Strategies

Alert on any HTTP request to /api/designer/v1/file-content originating from a non-loopback address
Baseline the process tree of ten_manager and flag child processes such as sh, bash, ssh, or curl
Monitor file integrity on authorized_keys, cron directories, and TEN project graph files

Monitoring Recommendations

Forward TMAN Designer HTTP logs and host audit logs to a central SIEM for correlation
Enable Linux audit rules on open and openat syscalls targeting SSH and cron paths for the designer user
Track outbound connections initiated by the ten_manager process to identify post-exploitation reverse shells

How to Mitigate CVE-2026-85688

Immediate Actions Required

Restrict the TMAN Designer listener to 127.0.0.1 or a trusted management network via firewall rules
Stop TMAN Designer on any host where it is not actively required for development work
Audit authorized_keys, cron directories, and project graph files for unauthorized modifications
Rotate SSH keys and credentials that may have been exposed by the file-read primitive

Patch Information

No fixed release is referenced in the advisory metadata at the time of publication. Track the TEN Framework repository, the upstream issue #2187, and the VulnCheck Advisory for TEN Framework for patched versions and upgrade guidance.

Workarounds

Bind TMAN Designer to localhost only and access it through an SSH tunnel
Place the designer behind an authenticating reverse proxy that enforces mutual TLS or SSO
Run TMAN Designer as a dedicated, unprivileged user with no write access to authorized_keys, cron, or system paths
Use network segmentation to prevent untrusted hosts from reaching the designer port

bash

# Configuration example: restrict TMAN Designer to localhost and block remote access
# 1. Launch the designer bound to loopback only
export TMAN_DESIGNER_BIND_ADDR=127.0.0.1

# 2. Block remote access to the designer port at the host firewall (default 49483)
sudo iptables -A INPUT -p tcp --dport 49483 ! -s 127.0.0.1 -j DROP

# 3. Access the designer securely via SSH tunnel from an operator workstation
ssh -L 49483:127.0.0.1:49483 operator@ten-host