p PatchFirst

CVE-2026-59148

CVE-2026-59148 · Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.

CVSS 8.8 · Alta · EPSS 0,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • mockoon

    Versiones
    • < 9.7.0: Afectada

    Sin corrección publicada

  • @mockoon/commons-server npm

    Intervalos de versiones afectados
    • SEMVER: < 9.7.0

    Actualiza a 9.7.0

  • @mockoon/cli npm

    Intervalos de versiones afectados
    • SEMVER: < 9.7.0

    Actualiza a 9.7.0

Fuentes originales

Comprueba tu servidor →