NullHub Missing Authentication in Management API

Executive Summary

NullHub through 2026.5.29 has a missing authentication vulnerability in its /api management API. The auth_token field defaults to null and is never assigned, allowing unauthenticated attackers to send requests without Authorization or Origin headers to non-loopback listeners. This grants full control over agent instances, configuration rewrites including provider credentials, and management of cron jobs and MCP servers.

Useful 0 Not Useful 0

Detection Guidance

Check if NullHub is running on a non-loopback interface (e.g., 0.0.0.0) by inspecting network bindings. Use curl to send requests to /api endpoints without authentication headers. Example: curl -v http://<target-ip>:19800/api/settings. If responses contain sensitive data or configuration details, the system is likely vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Attackers can gain unauthorized access to the management API, allowing them to control agent instances, rewrite configurations including sensitive provider credentials, manage cron jobs, and manipulate MCP servers. This could lead to data breaches, service disruptions, or unauthorized system modifications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's principle of least privilege and HIPAA's access controls. Unauthorized access to sensitive configurations and credentials could result in non-compliance, potential fines, and data exposure risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NullHub to a patched version if available. If not, restrict API access to loopback (127.0.0.1) by binding the server to localhost only. Implement network-level controls like firewalls to block external access to the API port (default 19800). Monitor for unauthorized API activity.

Useful 0 Not Useful 0