CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
Remote attackers can execute privileged commands by spoofing webhook updates if the webhook secret is not configured in cc-connect.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108549?
CVE-2026-108549 is a critical missing authorization vulnerability in chenhg5 cc-connect, published on 10 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.
Weakness: CWE-306
Which versions are affected by CVE-2026-108549?
How do I fix CVE-2026-108549?
No fix has been published for CVE-2026-108549 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-108549 being exploited?
There is no known exploitation of CVE-2026-108549 in the wild and no public exploit code.
Sources
Also known as GHSA-h8j8-r6g6-37hc.