CVE-2026-103053
Received Received - Intake

Unauthenticated API Access in AiSOC Response-Action Endpoints

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulnCheck

Description
AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103053
EUVD
EUVD-2026-89537

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
beenuar aisoc to 12.0.0 (exc)
beenuar aisoc to 11.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103053 is an authentication bypass vulnerability in AiSOC versions 9.0.0 to 11.2.0. When development mode is enabled (default) and the actions service token is unset, unauthenticated attackers can access sensitive API endpoints. This allows listing integrations, submitting actions on behalf of users, and dispatching containment actions using vendor credentials.

Detection Guidance

Check if AiSOC is running in development mode by inspecting environment variables in the Docker Compose configuration. Verify if AISOC_ACTIONS_SERVICE_TOKEN is set. If not, the system is vulnerable. Use curl to test unauthenticated access to API endpoints like /api/v1/live-actions/dispatch with a GET request.

Impact Analysis

Unauthenticated attackers with network access can perform privileged actions like isolating hosts, disabling accounts, blocking IPs, or running scripts. They may also enumerate response-action integrations and approve unauthorized actions. The default Docker Compose setup makes this exploitable without additional configuration.

Compliance Impact

This vulnerability could lead to unauthorized access and actions on systems, violating data integrity and access control requirements in GDPR (Article 32) and HIPAA (Security Rule). Unauthorized actions may result in data breaches or improper access, requiring breach notifications and potential fines.

Mitigation Strategies

Upgrade AiSOC to version 12.0.0 or later. Ensure AISOC_ACTIONS_SERVICE_TOKEN is generated and set in the environment. Disable AISOC_DEV_MODE if not needed. Verify authentication is enforced on all API endpoints by testing access with and without tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103053. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart