CVE-2026-109823 Host filesystem path disclosure via DNS rebinding
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-109823?
CVE-2026-109823 is a low-severity vulnerability in tidewave-ai tidewave, published on 27 Oct 2026.
Official description
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.
Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.
This issue affects tidewave: from 0.8.0 before 0.9.2.
Weakness: CWE-497
Which versions are affected by CVE-2026-109823?
1 open source package ship an affected version, including tidewave.
| Package | Affected | Fixed in |
|---|---|---|
tidewave Hex | From 0.8.0 | 0.9.2 |
How do I fix CVE-2026-109823?
Upgrade tidewave to 0.9.2 or later.
Is CVE-2026-109823 being exploited?
There is no known exploitation of CVE-2026-109823 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-109823, GHSA-cw46-9gf7-56p5.