CVE-2026-90620
Received Received - Intake

Authentication Bypass in HexStrike AI API

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike_server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90620
EUVD
EUVD-2026-77187

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
0x4m4 hexstrike_ai to d689933ff579d839c676c82b231f8e98326c5f04 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated remote code execution flaw in HexStrike AI up to a specific commit. The issue is in the hexstrike_server.py file where the /api/command endpoint accepts raw shell commands without validation or authentication. Attackers can send crafted POST requests to execute arbitrary commands on the server remotely.

Detection Guidance

Check if the HexStrike AI service is running on port 8888 across all network interfaces by using commands like 'netstat -tulnp | grep 8888' or 'ss -tulnp | grep 8888'. Send a test POST request to '/api/command' with a harmless command like 'echo test' to verify if the endpoint accepts and executes commands without authentication.

Impact Analysis

An attacker could gain full control over the server by executing malicious commands like reverse shells. This could lead to data theft, system compromise, or further network infiltration. The impact includes unauthorized access, potential data breaches, and disruption of services.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. GDPR mandates strong access controls and breach notification, while HIPAA requires safeguards against unauthorized access. Exploitation could result in regulatory penalties due to compromised sensitive data.

Mitigation Strategies

Disable the HexStrike AI service if not needed. If required, restrict the service to localhost by modifying the server to bind to 127.0.0.1 instead of 0.0.0.0. Implement strong authentication for the API endpoint and remove the generic command execution functionality. Ensure no sensitive data is exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart