PatchSiren cyber security CVE debrief

CVE-2026-111617 MGdaasLab CVE debrief

WHartTest through 2.8.1 contains a missing authentication vulnerability on UI-Automation WebSocket endpoints. Attackers can connect to /ws/ui/web/ and /ws/ui/actuator/ without authentication, allowing them to intercept test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions. This vulnerability allows unauthenticated attackers to potentially intercept test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions. Defenders responsible for WHartTest deployments should assess exposure and prioritize implementing authentication mechanisms for UI-Automation WebSocket endpoints.

Vendor: MGdaasLab
Product: WHartTest
CVSS: MEDIUM 6.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-16
Original CVE updated: 2026-10-16
Advisory published: 2026-10-16
Advisory updated: 2026-10-16

Who should care

Defenders responsible for WHartTest deployments, especially in environments where unauthorized access could lead to significant impact, should assess exposure and prioritize implementing authentication mechanisms for UI-Automation WebSocket endpoints.

Why it matters

The missing authentication vulnerability in WHartTest through 2.8.1 on UI-Automation WebSocket endpoints allows unauthenticated attackers to potentially intercept test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions. Defenders responsible for WHartTest deployments should assess exposure and prioritize implementing authentication mechanisms.

Potential interception of test-case payloads
Potential spoofing of results and screen frames into victim sessions
Potential unauthorized access to broadcast step results
Verification of authentication mechanisms for UI-Automation WebSocket endpoints

Technical summary

The WHartTest UI-Automation WebSocket endpoints lack authentication, allowing unauthenticated attackers to connect and potentially intercept test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions. The vulnerability is identified in WHartTest versions up to 2.8.1, and defenders should prioritize verifying exposure of UI-Automation WebSocket endpoints in WHartTest deployments. Implementing authentication mechanisms for UI-Automation WebSocket endpoints can help mitigate the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of UI-Automation WebSocket endpoints in WHartTest deployments, especially in environments where unauthorized access could lead to significant impact.

Recommended defensive actions

Verify exposure of UI-Automation WebSocket endpoints in WHartTest deployments
Assess the impact of potential unauthorized access to test-case payloads and broadcast step results
Implement authentication mechanisms for UI-Automation WebSocket endpoints
Monitor for suspicious activity on UI-Automation WebSocket endpoints
Review compensating controls for exposed systems while remediation is scheduled and verified
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in WHartTest through 2.8.1. The NVD entry is currently UNASSIGNED. The vulnerability was identified in WHartTest versions up to 2.8.1, and it is recommended to verify the exposure of UI-Automation WebSocket endpoints in WHartTest deployments. The source item and CVE record provide further information on the vulnerability, but additional verification is necessary to confirm affected scope and severity.

Sources and references

Verified primary and authoritative sources

CVE-2026-111617 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-111617

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-111617 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111617

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111617.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://hackmd.io/@hieuPenguinnn/wharttest-ui-automation-websocket-missing-authentication

Supplemental source - third-party-advisory
Source reference
Unverified legacy reference

URL: https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/wharttest_django/asgi.py

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/ui_automation/consumers.py

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/wharttest-through-2.8.1-missing-authentication-on-ui-automation-websocket-endpoints

Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.