CVE-2026-59148 Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Unauthenticated access to Mockoon's admin API allows attackers to steal secrets and modify mock server state due to missing authentication and permissive CORS settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59148?
CVE-2026-59148 is a high-severity missing authorization vulnerability in mockoon, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.
Which versions are affected by CVE-2026-59148?
4 open source packages ship an affected version, including @mockoon/cli and @mockoon/commons-server.
| Package | Affected | Fixed in |
|---|---|---|
@mockoon/cli npm | All versions | 9.7.0 |
@mockoon/cli npm | All versions | 9.7.0 |
@mockoon/commons-server npm | All versions | 9.7.0 |
@mockoon/commons-server npm | All versions | 9.7.0 |
How do I fix CVE-2026-59148?
Upgrade @mockoon/cli to 9.7.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-59148 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59148 exists.
Sources
Also known as GHSA-rqx4-3f6q-3x2v.