CVE-2026-104058 Podgrab Missing Authentication on WebSocket /ws Endpoint
Unauthenticated attackers can access the WebSocket endpoint to hijack playback queues and expose sensitive media metadata and file paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104058?
CVE-2026-104058 is a medium-severity missing authorization vulnerability in akhilrex podgrab, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.
Weakness: CWE-306
Which versions are affected by CVE-2026-104058?
How do I fix CVE-2026-104058?
No fix has been published for CVE-2026-104058 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-104058 being exploited?
There is no known exploitation of CVE-2026-104058 in the wild and no public exploit code.
Sources
Also known as GHSA-4wcx-j3g3-fcpv.