PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-66420 Ylianst CVE debrief

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance. The vulnerability exists in MeshCentral 1.1.21 and is caused by an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. This allows attackers to open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance. Administrators and users of MeshCentral 1.1.21, especially those using self-signed certificates, should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Vendor
Ylianst
Product
MeshCentral
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-09-09
Advisory published
2026-07-30
Advisory updated
2026-09-09

Who should care

Administrators and users of MeshCentral 1.1.21, especially those using self-signed certificates, should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Technical summary

The vulnerability exists in MeshCentral 1.1.21 and is caused by an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. This allows attackers to open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

Defensive priority

CVE-2026-66420 is rated HIGH with a CVSS score of 8.6, indicating a serious vulnerability in MeshCentral 1.1.21 that could allow unauthenticated remote attackers to hijack administrator sessions.

Recommended defensive actions

  • Inventory MeshCentral instances and verify if self-signed certificates are in use.
  • Restrict access to WebSocket endpoints to only trusted origins.
  • Implement additional monitoring to detect potential exploitation attempts.
  • Apply the vendor's remediation as soon as it becomes available.
  • Consider using alternative certificate types if possible.

Evidence notes

The vulnerability exists in MeshCentral 1.1.21 and is caused by an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. This allows attackers to open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-66420 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-66420

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-66420 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-66420

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.