CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection
Remote attackers can execute arbitrary code via the Authenticate function in cc-connect's webhook handler, requiring immediate attention due to public exploit availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76760?
CVE-2026-76760 is a medium-severity code injection vulnerability in chenhg5 cc-connect, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.
Which versions are affected by CVE-2026-76760?
How do I fix CVE-2026-76760?
No fix has been published for CVE-2026-76760 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-76760 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76760 exists.
Sources
Also known as GHSA-wfx9-6h8h-f3gm.