CVE-2026-67594 yolanmees CVE debrief

Who should care

Users of Spikster, especially those with exposed API routes, should verify their version and configuration to determine if vulnerable. Security teams and administrators responsible for Spikster deployments should prioritize patching or applying compensating controls to mitigate the risk of unauthenticated remote access.

Technical summary

The Spikster project contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes. The CipiAuth middleware is registered but never applied to any route in the API routing configuration, leaving approximately 50 unprotected API endpoints. Attackers can exploit this issue to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users.

Defensive priority

Critical vulnerability in Spikster allowing unauthenticated remote access to API routes.

Recommended defensive actions

• Verify Spikster version and configuration to determine if vulnerable
• Apply patches or updates to enable CipiAuth middleware for API routes
• Implement compensating controls, such as IP restrictions or monitoring, until patch is applied
• Review API routing configuration to ensure CipiAuth middleware is properly applied
• Conduct inventory checks to identify potentially affected systems

Evidence notes

The CVE-2026-67594 vulnerability in Spikster allows unauthenticated remote attackers to access all API routes due to the unattached CipiAuth middleware. This issue was reported through a source item from Vulncheck, which provided details on the vulnerability's impact, including the ability to enumerate and provision servers, reset root passwords, read and write arbitrary files, and create database users. Further verification is recommended to confirm affected versions and scope.

Official resources