CVE-2026-108854 UnicomAI CVE debrief

Who should care

Defenders responsible for Wanwu deployments, especially those using versions before 0.6.3, should assess exposure and prioritize remediation efforts. This includes reviewing the current version of Wanwu, verifying access controls, and monitoring for suspicious activity. Additionally, defenders should consider upgrading to Wanwu version 0.6.3 or later to mitigate the vulnerability.

Why it matters

CVE-2026-108854 is a medium-severity vulnerability in Wanwu that allows authenticated users to delete other users' AppKeys, potentially breaking MCP and OpenAPI clients. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially if using Wanwu versions before 0.6.3.

• Authenticated users can delete other users' AppKeys, potentially breaking MCP and OpenAPI clients.
• Exposure may require verification of Wanwu version and access controls.
• Remediation efforts should focus on upgrading to Wanwu version 0.6.3 or later.

Technical summary

The vulnerability allows authenticated users to delete other users' AppKeys by supplying a numeric apiId in the DELETE /v1/appspace/app/key request. This issue affects Wanwu versions before 0.6.3 and is caused by inadequate access controls on the DELETE /v1/appspace/app/key endpoint. The vulnerability can result in a loss of functionality for MCP and OpenAPI clients that rely on these AppKeys. The CVE record and source item from cve_program_cvelist_v5 provide additional information about the vulnerability, but the details are limited.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if using Wanwu versions before 0.6.3.

Recommended defensive actions

• Verify Wanwu version and assess exposure
• Restrict access to DELETE /v1/appspace/app/key endpoint
• Monitor for suspicious AppKey deletion activity
• Consider upgrading to Wanwu version 0.6.3 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and source item from cve_program_cvelist_v5. Limited details are available about affected versions and remediation efforts. The CVE record was published on 2026-10-11T13:26:03.304Z and has not been modified since then. The source item from cve_program_cvelist_v5 provides additional information about the vulnerability, but the details are limited. The vulnerability has been confirmed to affect Wanwu versions before 0.6.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.