CVE-2026-116485 huangxd- CVE debrief

Who should care

Defenders and operators of danmu_api installations should assess exposure and verify remediation. They should prioritize verifying exposure and remediation for unauthenticated environment configuration modification in danmu_api before 1.21.7. This includes reviewing compensating controls, checking relevant monitoring, detection, and logs for exposed assets, and tracking exceptions.

Why it matters

Defenders should prioritize verifying exposure and remediation for unauthenticated environment configuration modification in danmu_api before 1.21.7.

• Unauthenticated environment configuration modification
• Potential SSRF via redirecting OTHER_SERVER or PROXY_URL
• Possible lockout of operators by setting ADMIN_TOKEN

Technical summary

danmu_api before 1.21.7 contains an authentication bypass vulnerability allowing unauthenticated attackers to modify server environment configuration, potentially leading to SSRF via redirecting OTHER_SERVER or PROXY_URL and possible lockout of operators by setting ADMIN_TOKEN. Defenders should prioritize verifying exposure and remediation for unauthenticated environment configuration modification in danmu_api before 1.21.7. The vulnerability allows unauthenticated environment configuration modification, which could lead to SSRF and operator lockout.

Defensive priority

Defenders should prioritize verifying exposure and remediation for unauthenticated environment configuration modification.

Recommended defensive actions

• Verify danmu_api version and configuration
• Check for ADMIN_TOKEN and TOKEN settings
• Restrict access to /api/env/set, /api/env/add, and /api/env/del endpoints
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the authentication bypass vulnerability in danmu_api before 1.21.7. The vulnerability allows unauthenticated environment configuration modification, which could lead to SSRF and operator lockout. Defenders should verify exposure and remediation for unauthenticated environment configuration modification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.