The vulnerability originates in the telemetry subsystem of AnyCable, where a hardcoded public authentication token is used and command‑line arguments that may contain secrets such as --secret, --jwt_secret, or --http_rpc_secret are read and transmitted. The absence of source‑level visibility of these credentials means that sensitive information is exposed outside the process. This represents a confidential information disclosure vulnerability rather than code execution, aligning with CWE‑312 and CWE‑798.

AnyCable anycable is affected when running anycable versions prior to the release of v1.6.15. Users deploying earlier releases are at risk unless they upgrade to the patched version that removes the hardcoded token and stops sending secret‑laden arguments.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not available, leaving the exploitation likelihood uncertain. The vulnerability is not listed in CISA KEV. The attack vector is likely internal or network‑side depending on how telemetry data is transmitted; an attacker who can observe telemetry traffic could capture authentication secrets, although the vulnerability does not directly provide remote code execution or privilege escalation.