Description
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated origin validation bypass in the WebSocket gateway
Action: Patch Upgrade
AI Analysis

Impact

The pi‑agent‑dashboard WebSocket Gateway contains an origin validation flaw. By manipulating the cwd argument during a WebSocket connection, an attacker can trigger an origin validation error. This allows the attacker to reach the gateway without passing proper origin checks, providing unauthenticated access to the service.

Affected Systems

BlackBeltTechnology pi-agent-dashboard, all releases up to and including version 0.8.0 are impacted. Any deployment of these versions is vulnerable regardless of the environment size or configuration.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, so the exploitation probability is unclear, and the vulnerability is not present in the CISA KEV catalog. The flaw can be exploited remotely via the WebSocket interface, and the public disclosure suggests that attackers may already be attempting to target affected installations. The overall risk is moderate for unpatched environments that expose the gateway to external networks.

Generated by OpenCVE AI on October 19, 2026 at 10:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade BlackBeltTechnology pi-agent-dashboard to version 0.9.0 or later to apply the origin validation fix.
  • Restrict the WebSocket server to only accept connections from trusted networks or specific trusted origins, closing the port or disabling the service for untrusted interfaces.
  • If a patch cannot be applied immediately, segregate the gateway from external networks using firewalls or network segmentation to block unsolicited WebSocket traffic until the patch is deployed.

Generated by OpenCVE AI on October 19, 2026 at 10:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.
Title BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
First Time appeared Blackbelttechnology
Blackbelttechnology pi-agent-dashboard
Weaknesses CWE-345
CWE-346
CPEs cpe:2.3:a:blackbelttechnology:pi-agent-dashboard:*:*:*:*:*:*:*:*
Vendors & Products Blackbelttechnology
Blackbelttechnology pi-agent-dashboard
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Blackbelttechnology Pi-agent-dashboard
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T16:57:14.652Z

Reserved: 2026-10-18T17:28:39.855Z

Link: CVE-2026-112101

cve-icon Vulnrichment

Updated: 2026-10-19T16:56:44.415Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T10:16:46.610

Modified: 2026-10-19T17:17:12.347

Link: CVE-2026-112101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:00:13Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-346

    Origin Validation Error