{"vulnerability": "CVE-2026-6340", "sightings": [{"uuid": "1b76e5da-4d3c-4945-b680-63ded6774709", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6340", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hmztahz2c", "content": "CVE-2026-6340 - Memory Exhaustion via Malicious 7zip File Upload\nCVE ID : CVE-2026-6340\n \n Published : May 18, 2026, 7:08 a.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip ar...", "creation_timestamp": "2026-05-18T08:32:09.947236Z"}, {"uuid": "53c89a4e-745e-42f7-a1ed-cf8158a3db79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63406", "type": "published-proof-of-concept", "source": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm", "content": "", "creation_timestamp": "2026-09-18T18:35:12.358089Z"}, {"uuid": "0c423b5f-6736-4331-826e-fd2d3741a4e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63405", "type": "published-proof-of-concept", "source": "https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327", "content": "", "creation_timestamp": "2026-09-18T18:35:14.258850Z"}, {"uuid": "a541f85f-23e1-4f40-915a-55dff784c275", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63406", "type": "seen", "source": "https://gist.github.com/alon710/fd624de3e5c184e4dc7cfa7413a6955a", "content": "# CVE-2026-63406: CVE-2026-63406: Information Disclosure via Insecure Telemetry and Hardcoded Credentials in AnyCable-Go\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63406\n\n## Summary\nCVE-2026-63406 is an information disclosure vulnerability in AnyCable-go prior to version 1.6.15. The built-in telemetry client is enabled by default with a hardcoded public authentication token ('secret'). This client digests highly sensitive configuration parameters and command-line arguments, including JWT secrets and RPC secrets, into a stable SHA-256 fingerprint. This fingerprint is sent over public networks, exposing those administrative secrets to offline dictionary and brute-force attacks if intercepted.\n\n## TL;DR\nAnyCable-Go's default telemetry configuration used a public token and digested raw command-line secrets into an unsalted SHA-256 fingerprint, exposing administrative credentials to offline cracking if network traffic was captured.\n\n## Technical Details\n\n- **CWE ID**: CWE-798, CWE-312\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.9 (Medium)\n- **EPSS Score**: 0.0\n- **Exploit Status**: Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- AnyCable (anycable-go)\n- **anycable-go**: < 1.6.15 (Fixed in: `1.6.15`)\n\n## Mitigation\n\n- Upgrade AnyCable-Go to version 1.6.15 or newer\n- Pass secrets via environment variables instead of command-line arguments\n- Block outbound TCP connections to telemetry.anycable.io\n\n**Remediation Steps:**\n1. Identify current AnyCable-Go version using 'anycable-go --version'\n2. Download and deploy version 1.6.15 or later\n3. Verify that the telemetry message 'Anonymized telemetry is on' is no longer displayed in the server logs\n4. If updating is delayed, migrate '--secret' and '--jwt_secret' flags to corresponding environment variables\n\n## References\n\n- [GitHub Security Advisory GHSA-w72w-9qmj-c9qm](https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm)\n- [NVD CVE-2026-63406 Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-63406)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63406) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T12:31:31.917435Z"}, {"uuid": "e6e10952-a86b-4d4a-9443-34a3f838d27e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63405", "type": "seen", "source": "https://gist.github.com/alon710/5e8f8e10b5d10b651ea44234a36a9e37", "content": "# CVE-2026-63405: CVE-2026-63405: Insufficient Verification of Data Authenticity in AnyCable Pusher REST API\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63405\n\n## Summary\nAnyCable is a real-time communication server. Prior to version 1.6.15, its Pusher-compatible REST API suffered from an authentication bypass vulnerability because it failed to verify that the request body matched the signature-validated body_md5 parameter. This allows attackers to perform replay attacks with modified body contents.\n\n## TL;DR\nAnyCable's Pusher-compatible REST API failed to validate that the HTTP POST request body matched the signature-verified body_md5 parameter, enabling arbitrary message injection via request replays.\n\n## Technical Details\n\n- **CWE ID**: CWE-345 / CWE-294\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **Exploit Status**: None (No public exploit available)\n- **EPSS Score**: 0.00172 (0.17%)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- AnyCable Go Server (anycable-go)\n- **anycable-go**: < 1.6.15 (Fixed in: `1.6.15`)\n\n## Mitigation\n\n- Upgrade AnyCable to version 1.6.15 or later\n- Enforce maximum request body size limits at the reverse proxy layer to prevent potential denial of service via memory exhaustion during MD5 calculations\n- Restrict access to Pusher-compatible API endpoints using network firewalls or security groups\n\n**Remediation Steps:**\n1. Update the anycable-go dependency to v1.6.15 in your go.mod file using 'go get github.com/anycable/anycable-go@v1.6.15'\n2. Rebuild and redeploy the AnyCable server binary to production\n3. Configure your reverse proxy (e.g., Nginx client_max_body_size) to limit maximum request sizes on the Pusher API path\n\n## References\n\n- [GitHub Security Advisory GHSA-5p54-whvp-x327](https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327)\n- [Fix Commit d2cbadec792f038f4695c84a65c0d957b0fde72c](https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c)\n- [AnyCable v1.6.15 Release Notes](https://github.com/anycable/anycable/releases/tag/v1.6.15)\n- [NVD - CVE-2026-63405](https://nvd.nist.gov/vuln/detail/CVE-2026-63405)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63405) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T15:31:24.021861Z"}, {"uuid": "004cac41-26a9-48e7-af4b-2de7b9048806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63409", "type": "seen", "source": "https://bsky.app/profile/synergyapp.bsky.social/post/3mwh6jm6x4e2c", "content": "Synergy 1 (v1.21.3) closes CVE-2026-63409, CVE-2026-65832, CVE-2026-65976 and GHSA-vxgx-6p4m-fv83. Each one is data from another computer that the client mishandled. symless.com/synergy/down...", "creation_timestamp": "2026-09-26T21:00:25.412720Z"}]}