CVE-2026-94040 vas3k CVE debrief

Who should care

Defenders responsible for vas3k TaxHacker deployments should assess exposure and prioritize verification and mitigation efforts. This includes reviewing system inventories, understanding the potential impact of server-side request forgery, and taking steps to verify affected versions and apply patches or mitigations. Security teams and vulnerability management teams should also be aware of the potential risks and coordinate with operators and platform

Why it matters

CVE-2026-94040 is a server-side request forgery vulnerability in vas3k TaxHacker up to version 0.8.5. Defenders should verify exposure, prioritize patching, and monitor for suspicious activity. The vulnerability allows remote attackers to manipulate arguments to the testLLMProviderAction function, potentially leading to unauthorized requests. Evidence is limited, and further verification is required to determine the full impact and remediation steps.

• Potential unauthorized requests to internal or external resources
• Possible data breaches or system compromise
• Need for verification of affected versions and application of patches
• Importance of monitoring for suspicious request patterns

Technical summary

The testLLMProviderAction function in app/(app)/apps/settings/actions.ts of vas3k TaxHacker up to version 0.8.5 is vulnerable to server-side request forgery. This vulnerability allows remote attackers to manipulate the provider, apiKey, model, and baseUrl arguments, potentially leading to unauthorized requests. The issue arises from improper handling of these arguments, which could be exploited to perform actions on behalf of the server, interacting with internal or external resources without proper authorization or validation.

Defensive priority

Defenders should prioritize verifying the affected version and applying patches or mitigations. Inventory checks and monitoring for suspicious requests are recommended.

Recommended defensive actions

• Verify the affected version of vas3k TaxHacker and apply patches or mitigations
• Conduct inventory checks to identify potentially vulnerable instances
• Monitor for suspicious requests that could indicate exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in vas3k TaxHacker up to version 0.8.5, specifically in the testLLMProviderAction function within the app/(app)/apps/settings/actions.ts file. However, the impact and remediation steps require further verification from official sources. Limited evidence suggests that remote attackers could manipulate provider, apiKey, model, and baseUrl arguments, potentially leading to unauthorized requests. Defenders should verify exposure, prioritize patching, and monitor for unusual

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.