CVE-2026-90620

0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike_server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

A missing authentication check in the hexstrike_server.py file allows remote actors to invoke an unknown API command endpoint without credentials, enabling unauthorized command execution. The flaw resides in an unproven function of the file that is exposed through the component’s API, and the attack can be launched from outside the network.

Affected Systems

The vulnerability affects 0x4m4’s HexStrike AI product. No specific version numbers are provided in the advisory because the project uses continuous delivery with rolling releases; the issue applies to all releases up to the commit d689933ff579d839c676c82b231f8e98326c5f04.

Risk and Exploitability

The CVSS score is 6.9, indicating a medium severity vulnerability. EPSS score is <1%, indicating a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Because the flaw permits unauthenticated access to the command endpoint, remote exploitation is straightforward for an attacker who can reach the service over the network.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for and apply any new releases of HexStrike AI that fix the missing authentication bug; available.
  • Restrict network access to the command endpoint using firewall rules so that only trusted surface cannot be applied immediately, consider disabling or removing the hexstrike_server.py endpoint to prevent unauthorized command execution until a fix is released.
  • Deploy an API gateway or reverse proxy to enforce basic authentication or token validation on the command endpoint until the vendor releases an official fix.

Generated by OpenCVE AI on September 15, 2026 at 16:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike_server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Title 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication
First Time appeared 0x4m4
0x4m4 hexstrike Ai
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:0x4m4:hexstrike_ai:*:*:*:*:*:*:*:*
Vendors & Products 0x4m4
0x4m4 hexstrike Ai
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 2:59 PM
Reserved
Sep 12, 2026, 8:17 PM

View source JSON

Updated
Sep 14, 2026, 2:59 PM

JSON

Status
Deferred
Published
Sep 14, 2026, 3:16 AM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 17, 2026, 7:46 PM

JSON