CVE-2026-86543: Knowns API Authentication Bypass Vulnerability

CVE-2026-86543 Overview

CVE-2026-86543 is a missing authentication vulnerability [CWE-306] in the knowns project (knowns-dev/knowns) affecting all versions before 0.30.0. The management API is served without authentication on all network interfaces by default, and fresh installations require no password. An unauthenticated remote attacker can reach the /api/tunnel/start endpoint to provision a public tunnel, republishing the management API at a publicly accessible address. This exposes the API to the internet even when the host is behind a firewall or NAT.

Critical Impact
Unauthenticated attackers with network access to the API can provision a public tunnel and take full administrative control of the affected instance.

Affected Products

knowns (knowns-dev/knowns) versions prior to 0.30.0
Fresh installations with no password configured
Deployments binding the management API to all interfaces by default

Discovery Timeline

2026-09-07 - CVE-2026-86543 published to NVD
2026-09-08 - Last updated in NVD database
v0.30.0 - Fix released in GitHub Release v0.30.0

Technical Details for CVE-2026-86543

Vulnerability Analysis

The vulnerability stems from two design defects that compound each other. First, the management API binds to all network interfaces by default. Second, fresh installations start with no password, and the authentication middleware permits requests when no password is set. Combined, these behaviors allow unauthenticated callers on the network to invoke privileged endpoints.

The /api/tunnel/start endpoint, defined in internal/server/routes/tunnel.go, provisions a public tunnel that republishes the API at an internet-reachable address. An attacker who can reach the local API can therefore pivot the exposure from LAN-only to worldwide without credentials. Additional detail is available in the VulnCheck advisory and the GHSA-fc85-99vc-9c75 security advisory.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The server auth logic in internal/server/auth.go does not enforce credentials when no password is configured. The CLI in internal/cli/browser.go also allowed enabling --tunnel without requiring a password.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the management API. The attacker calls the tunnel provisioning route to expose the API on a public URL, then issues administrative API calls against that tunnel with no credentials.

// Patch: internal/cli/browser.go - require --password when --tunnel is set
tunnelFlag, _ := cmd.Flags().GetBool("tunnel")
passwordFlag, _ := cmd.Flags().GetString("password")
allowTaskHardDelete, _ := cmd.Flags().GetBool("allow-task-hard-delete")
if tunnelFlag && strings.TrimSpace(passwordFlag) == "" {
    return fmt.Errorf("--tunnel requires --password to protect the public server")
}

store, projectRoot := resolveProject(cmd)

Source: GitHub Commit 878a02c. This patch blocks tunnel activation unless a password is provided, closing the public-exposure path.

// Patch: internal/server/routes/auth.go - gate password removal via callback
type AuthRoutes struct {
    auth              AuthProvider
    broadcaster       Broadcaster
    canRemovePassword func() bool
}

func SetupAuthRoutes(r chi.Router, auth AuthProvider, broadcaster Broadcaster, canRemovePassword ...func() bool) {
    ar := &AuthRoutes{auth: auth, broadcaster: broadcaster}
    if len(canRemovePassword) > 0 {
        ar.canRemovePassword = canRemovePassword[0]
    }
    r.Get("/status", ar.getStatus)
    r.Post("/login", ar.login)
    r.Post("/password", ar.setPassword)

Source: GitHub Commit 878a02c.

Detection Methods for CVE-2026-86543

Indicators of Compromise

Unauthenticated HTTP requests to /api/tunnel/start on hosts running knowns
Outbound connections from knowns processes establishing tunnel sessions to third-party tunneling services
New public tunnel URLs referenced in knowns logs on freshly installed instances
The knowns server bound to 0.0.0.0 on non-loopback interfaces without a configured password

Detection Strategies

Inventory installations and flag any version earlier than 0.30.0 for immediate remediation
Alert on any HTTP request path containing /api/tunnel/start where the source is not an approved administrator
Baseline expected outbound tunneling destinations and alert on new connections from knowns hosts to public tunneling providers
Correlate knowns process starts with listeners on non-loopback interfaces to identify exposed instances

Monitoring Recommendations

Ingest process, network, and HTTP telemetry from hosts running knowns into a centralized analytics platform
Monitor for administrative API calls that occur without a preceding successful /login event
Track configuration drift where the knowns password state transitions to empty or unset

How to Mitigate CVE-2026-86543

Immediate Actions Required

Upgrade knowns to version 0.30.0 or later using the v0.30.0 release
Set a strong password on every knowns installation before exposing the API to any network
Audit hosts for any active public tunnels started via /api/tunnel/start and revoke them
Restrict the management API bind address to loopback until the upgrade is complete

Patch Information

The fix is delivered in commit 878a02c and shipped in version 0.30.0. The patch requires a password when enabling --tunnel and gates password removal behind a server-side capability check. Additional context is available in GHSA-fc85-99vc-9c75.

Workarounds

Bind the API to 127.0.0.1 and access it only via SSH tunneling or a trusted reverse proxy
Place the service behind an authenticating reverse proxy that enforces credentials on every route
Block outbound connections from knowns hosts to public tunneling providers at the network egress
Disable use of the --tunnel flag operationally until upgrading to 0.30.0

bash

# Upgrade and verify version
go install github.com/knowns-dev/knowns@v0.30.0
knowns --version

# Start with a password and loopback-only binding
knowns serve --address 127.0.0.1:8080 --password "$(openssl rand -base64 32)"