CVE-2026-61791 schorschii CVE debrief

Who should care

Defenders responsible for OCO-Server instances, particularly those with self-registration enabled, should assess exposure and verify version 1.2.1 or later usage. They should also review agent-registration-key usage and self-registration settings, and monitor for suspicious activity on OCO-Server instances. Operators, administrators, and security teams should be aware of the potential impact of this vulnerability on their systems and take necessary steps.

Why it matters

CVE-2026-61791 is a stored XSS vulnerability in OCO-Server that allows an attacker to execute script in an administrator's authenticated session. Defenders should prioritize verifying and updating OCO-Server instances, reviewing self-registration settings, and monitoring for suspicious activity.

• Potential script execution in administrator's authenticated session
• Possible unauthorized actions within OCO-Server
• Required verification of OCO-Server version and self-registration settings
• Necessity to monitor for suspicious activity on OCO-Server instances

Technical summary

The OCO-Server application is vulnerable to stored XSS through agent hostnames in command buttons. An attacker with the shared agent-registration-key can store a crafted hostname, which can execute script in an administrator's authenticated session when an affected command button is activated. The vulnerability is caused by improper HTML escaping in the `Html::commandButton()` function. Defenders should prioritize verifying and updating OCO-Server instances to version 1.2.1 or later, and review agent-registration-key usage and self-registration settings.

Defensive priority

Defenders should prioritize verifying and updating OCO-Server instances to version 1.2.1 or later, and review agent-registration-key usage and self-registration settings.

Recommended defensive actions

• Verify OCO-Server version and update to 1.2.1 or later
• Review agent-registration-key usage and self-registration settings
• Monitor for suspicious activity on OCO-Server instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected version and fixed version. However, additional information on potential exploitation and impact is limited. Defenders should verify OCO-Server version and self-registration settings, and monitor for suspicious activity. The shared agent-registration-key is used to store an unchecked hostname, which can be used to exploit the vulnerability. Evidence is limited, and defenders should exercise caution when assessing exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.