Description
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.
Published: 2026-10-10
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode. When the webhook_secret is not configured, the webhook listener on port 8080 accepts updates without verifying the sender. A malicious actor can forge updates_id and instruct the host to run privileged commands, such as the /shell command, effectively enabling remote code execution on the machine running cc-connect. This weakness corresponds to CWE-306.

Affected Systems

The affected product is chenhg5:cc-connect (cc-connect version 1.5.0. Any deployment that uses this version with the MAX platform adapter and webhook mode enabled is vulnerable.

Risk and Exploitability

With a CVSS score of 9.2 the vulnerability is classified as high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker reaching the webhook listener on port 8080 can forge requests. Once the listener is reachable, the absence of authentication allows arbitrary command execution at privilege level of the host process.

Generated by OpenCVE AI on October 10, 2026 at 15:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a version of cc-connect that includes a fix for the missing authentication issue
  • Configure a webhook_secret to enable authentication for the MAX platform webhook listener
  • Restrict inbound traffic to the webhook listener port 8080 to trusted networks or localhost
  • Monitor the webhook endpoint for anomalous updates or repeated unauthorized attempts

Generated by OpenCVE AI on October 10, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Chenhg5
Chenhg5 cc-connect
Vendors & Products Chenhg5
Chenhg5 cc-connect

Sat, 10 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.
Title cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Chenhg5 Cc-connect
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T11:36:36.083Z

Reserved: 2026-10-10T14:24:42.862Z

Link: CVE-2026-108549

cve-icon Vulnrichment

Updated: 2026-10-13T11:36:24.789Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T15:16:57.973

Modified: 2026-10-13T12:17:12.747

Link: CVE-2026-108549

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T16:00:08Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function