{"vulnerability": "cve-2026-63406", "sightings": [{"uuid": "53c89a4e-745e-42f7-a1ed-cf8158a3db79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63406", "type": "published-proof-of-concept", "source": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm", "content": "", "creation_timestamp": "2026-09-18T18:35:12.358089Z"}, {"uuid": "a541f85f-23e1-4f40-915a-55dff784c275", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63406", "type": "seen", "source": "https://gist.github.com/alon710/fd624de3e5c184e4dc7cfa7413a6955a", "content": "# CVE-2026-63406: CVE-2026-63406: Information Disclosure via Insecure Telemetry and Hardcoded Credentials in AnyCable-Go\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63406\n\n## Summary\nCVE-2026-63406 is an information disclosure vulnerability in AnyCable-go prior to version 1.6.15. The built-in telemetry client is enabled by default with a hardcoded public authentication token ('secret'). This client digests highly sensitive configuration parameters and command-line arguments, including JWT secrets and RPC secrets, into a stable SHA-256 fingerprint. This fingerprint is sent over public networks, exposing those administrative secrets to offline dictionary and brute-force attacks if intercepted.\n\n## TL;DR\nAnyCable-Go's default telemetry configuration used a public token and digested raw command-line secrets into an unsalted SHA-256 fingerprint, exposing administrative credentials to offline cracking if network traffic was captured.\n\n## Technical Details\n\n- **CWE ID**: CWE-798, CWE-312\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.9 (Medium)\n- **EPSS Score**: 0.0\n- **Exploit Status**: Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- AnyCable (anycable-go)\n- **anycable-go**: < 1.6.15 (Fixed in: `1.6.15`)\n\n## Mitigation\n\n- Upgrade AnyCable-Go to version 1.6.15 or newer\n- Pass secrets via environment variables instead of command-line arguments\n- Block outbound TCP connections to telemetry.anycable.io\n\n**Remediation Steps:**\n1. Identify current AnyCable-Go version using 'anycable-go --version'\n2. Download and deploy version 1.6.15 or later\n3. Verify that the telemetry message 'Anonymized telemetry is on' is no longer displayed in the server logs\n4. If updating is delayed, migrate '--secret' and '--jwt_secret' flags to corresponding environment variables\n\n## References\n\n- [GitHub Security Advisory GHSA-w72w-9qmj-c9qm](https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm)\n- [NVD CVE-2026-63406 Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-63406)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63406) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T12:31:31.917435Z"}]}