PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110616 nullclaw CVE debrief

CVE-2026-110616 debrief based on source corpus. The vulnerability allows unauthenticated access to the /api/* management API, enabling attackers to control agent instances, rewrite configurations, and manage cron jobs and MCP servers. Defenders should assess exposure and prioritize remediation based on the critical severity of this vulnerability. The auth_token field defaults to null and is never assigned, which is the root cause of the missing authentication vulnerability. This vulnerability has a CVSS score of 9.2 and is considered critical.

Vendor
nullclaw
Product
NullHub
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for NullHub installations, security teams, and IT personnel should assess exposure and prioritize remediation based on the critical severity of this vulnerability. They should also verify current versions and authentication mechanisms, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-110616 is a critical vulnerability in NullHub that allows unauthenticated access to the management API. Defenders should assess exposure, prioritize remediation, and verify current versions and authentication mechanisms.

  • Potential unauthorized access to management API
  • Possible configuration changes by attackers
  • Risk of elevated privileges for attackers
  • Need for verification of current version and authentication mechanisms

Technical summary

The NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API. The auth_token field defaults to null and is never assigned, allowing attackers to control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers. This vulnerability has a CVSS score of 9.2 and is considered critical. The vulnerability is caused by the lack of authentication mechanisms in the /api/* management API.

Defensive priority

High

Recommended defensive actions

  • Review and update NullHub installations to ensure the latest version is used
  • Implement proper authentication mechanisms for the /api/* management API
  • Monitor for and restrict unauthorized access to the management API
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in NullHub through 2026.5.29. The auth_token field defaults to null and is never assigned, allowing unauthenticated attackers to access the /api/* management API. The vulnerability has a CVSS score of 9.2 and is considered critical. There is no information on known or unknown affected scope, but defenders should verify current versions and authentication mechanisms.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110616 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110616

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110616 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110616

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • NullHub through 2026.5.29 Missing Authentication for /api Management API

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110616.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nullclaw/nullhub

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.