CVE-2026-86808: Moltis Authentication Bypass Vulnerability

CVE-2026-86808 Overview

CVE-2026-86808 is a missing authentication vulnerability [CWE-287] affecting the moltis-org moltis project through version 20260818.10. The flaw resides in the vault_unlock_handler and vault_recovery_handler functions within vault.rs. Unauthenticated remote attackers can invoke these vault endpoints because the handlers do not enforce session authentication. The exploit has been disclosed publicly. Upgrading to version 20260819.01 remediates the issue via patch commit 3b92dd64d5648f829968cf48bf67dc3113852fef.

Critical Impact
Remote attackers can reach vault unlock and recovery routes without credentials, exposing decrypted provider keys, SSH private keys, environment variables, and channel tokens stored in the vault.

Affected Products

moltis-org moltis versions up to and including 20260818.10
Affected component: crates/httpd/src/auth_routes/vault.rs
Fixed in moltis release 20260819.01

Discovery Timeline

2026-09-08 - CVE-2026-86808 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86808

Vulnerability Analysis

The moltis HTTP daemon exposes vault management routes for unsealing and recovering the secret store. The vault_unlock_handler and vault_recovery_handler functions did not extract or validate an AuthSession, so any caller reaching the endpoint was treated as authorized. Unsealing the vault decrypts every stored secret at once, including provider keys, SSH private keys, environment variables, and channel tokens. Because /api/auth/* is allowlisted in is_public_path(), only the AuthSession extractor at the handler level enforced authentication, and its absence left the routes fully exposed.

Root Cause

The root cause is missing enforcement of authentication [CWE-287] on privileged handlers. The vault route handlers omitted the AuthSession extractor argument, bypassing the middleware contract that gates sensitive operations. Sensitive endpoints inherited the same permissive posture as intentionally public /api/auth/* routes.

Attack Vector

Exploitation requires only network reachability to the moltis HTTP interface. An attacker can send a JSON POST to the vault unlock or recovery endpoint without valid session cookies or tokens. A successful call triggers vault decryption workflows and returns or activates secrets that should be gated by an authenticated administrator session.

rust

     password: String,
 }
 
+/// Unseal the vault with the vault password.
+///
+/// Requires an authenticated session: unsealing decrypts every stored
+/// secret (provider keys, SSH private keys, env vars, channel tokens), so
+/// an unauthenticated caller must never be able to attempt it. `/api/auth/*`
+/// is allowlisted in `is_public_path()`, so the `AuthSession` extractor is
+/// what enforces auth here.
 #[cfg(feature = "vault")]
 pub(super) async fn vault_unlock_handler(
+    _session: crate::auth_middleware::AuthSession,
     State(state): State<AuthState>,
     Json(body): Json<VaultUnlockRequest>,
 ) -> impl IntoResponse {

Source: GitHub Commit 3b92dd6. The patch adds the _session: crate::auth_middleware::AuthSession extractor argument, forcing the framework to reject unauthenticated requests before the handler executes.

Detection Methods for CVE-2026-86808

Indicators of Compromise

HTTP POST requests to vault unlock or vault recovery endpoints originating from unexpected IP ranges or without preceding authentication traffic.
Successful vault unseal events in application logs that are not correlated with an administrator login.
Unexplained access or use of provider API keys, SSH keys, or channel tokens stored in the moltis vault.

Detection Strategies

Enable request logging on the moltis HTTP daemon and alert on any request to vault routes lacking a valid session identifier.
Correlate vault unseal or recovery events with authentication logs to detect handler invocations without prior login.
Monitor outbound activity from hosts running moltis for credential reuse patterns consistent with vault contents.

Monitoring Recommendations

Ingest moltis HTTP access logs into a centralized analytics platform and build detections for anomalous access to vault_unlock_handler and vault_recovery_handler routes.
Track the running moltis version across your fleet and flag any host still on 20260818.10 or earlier.
Alert on new outbound connections that use secrets known to be stored in the vault, especially from unusual source hosts.

How to Mitigate CVE-2026-86808

Immediate Actions Required

Upgrade moltis to release 20260819.01 or later, which applies patch commit 3b92dd64d5648f829968cf48bf67dc3113852fef.
Rotate every secret previously stored in the vault, including provider API keys, SSH private keys, environment variables, and channel tokens.
Restrict network access to the moltis HTTP daemon so only trusted management networks can reach vault endpoints.

Patch Information

The fix is available in the moltis 20260819.01 release and is tracked in pull request #1216 and issue #1177. The patch adds the AuthSession extractor to vault_unlock_handler and vault_recovery_handler, ensuring the middleware rejects unauthenticated callers.

Workarounds

Place the moltis HTTP daemon behind a reverse proxy that enforces authentication on /api/vault/* routes until the upgrade is deployed.
Apply firewall or service mesh policies that block external access to vault endpoints and restrict them to loopback or a management VLAN.
Temporarily disable the vault feature build if vault functionality is not required in the environment.

bash

# Example nginx snippet restricting vault routes to an internal management network
location ~ ^/api/vault/ {
    allow 10.0.0.0/24;   # management subnet
    deny  all;
    proxy_pass http://moltis_upstream;
}