CVE-2026-67594

Deferred Deferred - Pending Action

Authentication Bypass in Spikster via Unattached Middleware

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67594

EUVD

EUVD-2026-51276

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Spikster has a missing authentication vulnerability where the CipiAuth middleware is registered but not applied to any API routes. This allows unauthenticated remote attackers to access around 50 unprotected API endpoints. Attackers can use these endpoints to perform actions like enumerating servers, provisioning servers, resetting root passwords, reading or writing arbitrary files, and creating database users.

Detection Guidance

To detect this vulnerability, check if Spikster is running with unauthenticated API access. Inspect the API routing configuration for unprotected endpoints. Look for the unattached CipiAuth middleware in the codebase. Use network scanning tools to identify exposed API routes.

Impact Analysis

This vulnerability allows attackers to gain full control over affected systems. They can reset passwords, access sensitive files, create unauthorized database users, and provision or enumerate servers. This could lead to complete system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data and systems. GDPR requires strong authentication and access controls to protect personal data, while HIPAA mandates strict controls to safeguard protected health information. The lack of authentication here would result in non-compliance.

Mitigation Strategies

Immediately update Spikster to a patched version where the CipiAuth middleware is properly applied. Remove or restrict access to all unauthenticated API endpoints. Implement network-level access controls to block unauthorized API access. Review and audit all API routes for proper authentication.

Hi! I’m here to help you understand CVE-2026-67594. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70