CVE-2026-86543

Received Received - Intake

Management API Unauthenticated Access in Cloudflared

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-86543

EUVD

EUVD-2026-72561

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects software versions before 0.30.0, where the management API is exposed without authentication on all network interfaces by default. Fresh installations do not require a password, allowing attackers to access the /api/tunnel/start endpoint. This lets them provision a public tunnel and republish the API at a publicly accessible address.

Detection Guidance

Check if the management API is exposed on all network interfaces without authentication. Use commands like 'curl http://localhost:port/api/tunnel/start' or 'netstat -tulnp | grep <port>' to verify if the API is listening on all interfaces. Ensure the service is not running on default ports or misconfigured.

Impact Analysis

Attackers could exploit this to gain unauthorized access to the management API, potentially leading to full system compromise. Sensitive data exposure, unauthorized API usage, or complete takeover of the system are possible risks. The high CVSS score indicates severe impact.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strict access controls and data security; HIPAA mandates secure handling of sensitive health data. Unauthorized API access could lead to data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade to version 0.30.0 or later where authentication is enforced by default. If upgrading is not possible, restrict API access to trusted networks only, enable authentication, and disable the unauthenticated /api/tunnel/start endpoint immediately.

Hi! I’m here to help you understand CVE-2026-86543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70