Vulnerability-Lookup

CVE-2026-63406 (GCVE-0-2026-63406)

Vulnerability from cvelistv5 – Published: 2026-09-18 16:51 – Updated: 2026-09-18 17:02

Title

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Summary

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory's claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 17:02 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information
CWE-798 - Use of Hard-coded Credentials

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/anycable/anycable/security/adv…	x_refsource_CONFIRM
https://github.com/anycable/anycable/commit/201c6…	x_refsource_MISC
https://github.com/anycable/anycable/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
anycable	anycable	Affected: < 1.6.15	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63406",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:02:25.322916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T17:02:47.780Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "anycable",
          "vendor": "anycable",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory\u0027s claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798: Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T16:51:54.242Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
        },
        {
          "name": "https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee"
        },
        {
          "name": "https://github.com/anycable/anycable/releases/tag/v1.6.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/anycable/anycable/releases/tag/v1.6.15"
        }
      ],
      "source": {
        "advisory": "GHSA-w72w-9qmj-c9qm",
        "discovery": "UNKNOWN"
      },
      "title": "AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63406",
    "datePublished": "2026-09-18T16:51:54.242Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-09-18T17:02:47.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63406",
      "date": "2026-09-21",
      "epss": "0.00245",
      "percentile": "0.1602"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "anycable",
                "vendor": "anycable",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.6.15"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory\u0027s claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15."
          }
        ],
        "id": "CVE-2026-63406",
        "lastModified": "2026-09-18T18:17:10.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-63406",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:02:25.322916Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-18T17:16:59.620",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/anycable/anycable/releases/tag/v1.6.15"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-312"
              },
              {
                "lang": "en",
                "value": "CWE-798"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-63406",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-18T17:02:25.322916Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-18T17:02:35.284Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "anycable",
              "vendor": "anycable",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.6.15"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory\u0027s claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-312",
                  "description": "CWE-312: Cleartext Storage of Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-798",
                  "description": "CWE-798: Use of Hard-coded Credentials",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-18T16:51:54.242Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
            },
            {
              "name": "https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee"
            },
            {
              "name": "https://github.com/anycable/anycable/releases/tag/v1.6.15",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/anycable/anycable/releases/tag/v1.6.15"
            }
          ],
          "source": {
            "advisory": "GHSA-w72w-9qmj-c9qm",
            "discovery": "UNKNOWN"
          },
          "title": "AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-63406",
        "datePublished": "2026-09-18T16:51:54.242Z",
        "dateReserved": "2026-07-16T19:20:28.987Z",
        "dateUpdated": "2026-09-18T17:02:47.780Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-63406

Vulnerability from fkie_nvd - Published: 2026-09-18 17:16 - Updated: 2026-09-18 18:17

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee
	security-advisories@github.com	https://github.com/anycable/anycable/releases/tag/v1.6.15
	security-advisories@github.com	https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "anycable",
          "vendor": "anycable",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.15"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory\u0027s claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15."
    }
  ],
  "id": "CVE-2026-63406",
  "lastModified": "2026-09-18T18:17:10.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63406",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-18T17:02:25.322916Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-18T17:16:59.620",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/anycable/anycable/releases/tag/v1.6.15"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        },
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-W72W-9QMJ-C9QM

Vulnerability from github – Published: 2026-09-18 17:17 – Updated: 2026-09-18 17:17

Summary

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Details

Summary

The telemetry subsystem embeds a hardcoded auth token ("secret") in the public source and transmits raw CLI arguments—including --secret, --jwt_secret, and --http_rpc_secret values—to a third-party telemetry endpoint.

Details

In telemetry/config.go line 12, var authToken = "secret" is committed in the public repository and used to authenticate to https://telemetry.anycable.io. In telemetry/telemetry.go, clusterFingerprint() (line 320) calls both anycableFileConfig(c.ConfigFilePath) (line 333), which reads the full TOML config file contents, and anycableCLIArgs() (line 402), which reads os.Args[1:] verbatim—including any --secret=..., --jwt_secret=..., --http_rpc_secret=... arguments. Both raw values are passed to generateDigest() (line 373), meaning the actual secret strings flow through the code path and are included in telemetry data sent to the third-party server. Since the hardcoded authToken = "secret" is public, any attacker who can perform DNS hijacking or is positioned on the network path can intercept and read the telemetry payload containing operator credentials.

PoC

Read telemetry/config.go in the public repo to find authToken = "secret".
Set up a DNS spoof for telemetry.anycable.io pointing to an attacker-controlled server.
Start anycable-go with --secret=my-production-secret.
The server sends a POST to the attacker's endpoint with the telemetry JSON payload. The clusterFingerprint field contains data derived from raw os.Args including --secret=my-production-secret.

Impact

In MITM/DNS-hijack scenarios, production secrets (JWT secrets, broadcast keys, RPC auth) are exposed to third parties. The hardcoded authToken = "secret" provides no protection since it is known to anyone reading the open-source code.

Fix

Remove the hardcoded authToken from source; generate or require operator configuration at build time or deployment time. 2. Remove anycableCLIArgs() from the fingerprint computation, or sanitize it to exclude values of secret-bearing flags before hashing. 3. Add a documented opt-out mechanism for telemetry.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.14"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/anycable/anycable"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312",
      "CWE-798"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:17:29Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe telemetry subsystem embeds a hardcoded auth token (`\"secret\"`) in the public source and transmits raw CLI arguments\u2014including `--secret`, `--jwt_secret`, and `--http_rpc_secret` values\u2014to a third-party telemetry endpoint.\n\n### Details\nIn `telemetry/config.go` line 12, `var authToken = \"secret\"` is committed in the public repository and used to authenticate to `https://telemetry.anycable.io`. In `telemetry/telemetry.go`, `clusterFingerprint()` (line 320) calls both `anycableFileConfig(c.ConfigFilePath)` (line 333), which reads the full TOML config file contents, and `anycableCLIArgs()` (line 402), which reads `os.Args[1:]` verbatim\u2014including any `--secret=...`, `--jwt_secret=...`, `--http_rpc_secret=...` arguments. Both raw values are passed to `generateDigest()` (line 373), meaning the actual secret strings flow through the code path and are included in telemetry data sent to the third-party server. Since the hardcoded `authToken = \"secret\"` is public, any attacker who can perform DNS hijacking or is positioned on the network path can intercept and read the telemetry payload containing operator credentials.\n\n### PoC\n1. Read `telemetry/config.go` in the public repo to find `authToken = \"secret\"`.\n2. Set up a DNS spoof for `telemetry.anycable.io` pointing to an attacker-controlled server.\n3. Start anycable-go with `--secret=my-production-secret`.\n4. The server sends a POST to the attacker\u0027s endpoint with the telemetry JSON payload. The `clusterFingerprint` field contains data derived from raw `os.Args` including `--secret=my-production-secret`.\n\n### Impact\nIn MITM/DNS-hijack scenarios, production secrets (JWT secrets, broadcast keys, RPC auth) are exposed to third parties. The hardcoded `authToken = \"secret\"` provides no protection since it is known to anyone reading the open-source code.\n\n### Fix\n1. Remove the hardcoded `authToken` from source; generate or require operator configuration at build time or deployment time. 2. Remove `anycableCLIArgs()` from the fingerprint computation, or sanitize it to exclude values of secret-bearing flags before hashing. 3. Add a documented opt-out mechanism for telemetry.",
  "id": "GHSA-w72w-9qmj-c9qm",
  "modified": "2026-09-18T17:17:29Z",
  "published": "2026-09-18T17:17:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/anycable/anycable"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anycable/anycable/releases/tag/v1.6.15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63406 (GCVE-0-2026-63406)

FKIE_CVE-2026-63406

GHSA-W72W-9QMJ-C9QM

Summary

Details

PoC

Impact

Fix

Tags

Sightings

Nomenclature

Related by attack behaviour