CVE-2026-79574

Deferred Deferred - Pending Action

Remote Code Execution in mpush Gateway Server

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: MITRE

Description

An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-79574

Affected Vendors & Products

Vendor	Product	Version / Range
mpush	mpush	0.8.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-79574 is a Remote Code Execution (RCE) flaw in mpush v0.8.1 and earlier. The gateway server improperly handles a broadcast message's condition field, passing it unfiltered to Nashorn's jsEngine.eval() function. This allows attackers to execute arbitrary JavaScript code via a crafted broadcast message sent to port 3001.

Detection Guidance

To detect this vulnerability, monitor network traffic on port 3001 for unauthorized broadcast messages. Check server logs for suspicious JavaScript execution attempts or unexpected command outputs. Use packet inspection tools like tcpdump or Wireshark to capture raw TCP packets targeting the gateway server.

Impact Analysis

An attacker can exploit this to execute arbitrary commands on the server with the same privileges as the mpush service. This could lead to full system compromise, data theft, or unauthorized access. The attack requires only network access to port 3001 and no authentication.

Compliance Impact

This RCE vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements. Organizations using vulnerable mpush versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade mpush to a patched version beyond 0.8.1. Block external access to port 3001 using a firewall. Disable unauthenticated broadcast messages if possible. Monitor for signs of exploitation such as unexpected file creation or command execution.

Hi! I’m here to help you understand CVE-2026-79574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70