« Volver al listado

CVE-2026-46430

Estado: AplazadaMedia (4.3)—

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort("", ":5553") resolves to ":5553". This vulnerability is fixed in 1.17.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Algernon — AlgernonAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-46430",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46430",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T18:57:07.427124Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "xyproto",
          "product": "algernon",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.17.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T17:16:50.943",
  "references": [
    {
      "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-gj84-924c-48fx",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-gj84-924c-48fx",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        },
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = \"\" for non-Windows, and utils.JoinHostPort(\"\", \":5553\") resolves to \":5553\". This vulnerability is fixed in 1.17.7."
    },
    {
      "lang": "es",
      "value": "Algernon es un pequeño servidor web autocontenido y puro Go. Antes de la versión 1.17.7, el servidor de eventos SSE se enlazaba a 0.0.0.0:5553 en Linux/macOS por defecto porque el valor predeterminado del host dependiente de la plataforma en engine/flags.go:39-46 establecía host = \"\" para sistemas que no eran Windows, y utils.JoinHostPort(\"\", \":5553\") se resuelve como \":5553\". Esta vulnerabilidad se corrige en la versión 1.17.7."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}