CVE-2026-104891 insumermodel CVE debrief

Who should care

Defenders responsible for the npm packages @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate should assess exposure and prioritize verification and remediation. Defenders must verify the affected packages are not used in environments where free access could be exploited. Exposure could allow unauthorized access to paid routes. Remediation priority is high for environments using the affected versions. Further verification is needed to

Why it matters

CVE-2026-104891 allows free access to paid routes without proving control of the wallet, affecting the npm packages @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate.

• Defenders must verify the affected packages are not used in environments where free access could be exploited.
• Exposure could allow unauthorized access to paid routes.
• Remediation priority is high for environments using the affected versions.
• Further verification is needed to determine the full scope of affected systems and potential exploitation.

Technical summary

The mppx-condition-gate packages do not validate the relationship between the credential source and the payload, allowing an attacker to obtain free access to a route that should have been paid for by naming any qualifying address in the credential source. This vulnerability affects the npm packages @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate. The free-access path reads the payer address from credential.source, a client-supplied DID, and asks InsumerAPI whether that address satisfies the configured conditions without establishing control. An in-process cache then re-serves the grant without re-evaluating.

Defensive priority

Defenders should prioritize verifying the affected packages @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate, and assess exposure in their environments.

Recommended defensive actions

• Verify the affected packages @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate are not used in environments where free access could be exploited.
• Assess exposure by checking if the affected versions are in use.
• Update to the fixed versions 3.0.0 for @insumermodel/mppx-condition-gate and 1.0.4 for @insumermodel/mppx-token-gate.
• Monitor for potential exploitation attempts using the in-process cache.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The source corpus provides details on the vulnerability in the mppx-condition-gate packages, including the impact, affected versions 3.0.0 and 1.0.4 for @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate, and fixed versions. The vulnerability allows free access to paid routes without proving control of the wallet. Defenders must verify the affected packages are not used in environments where free access could be exploited. Exposure could allow unauthorized access to paid routes. Remediation priority is high for The m

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.