p PatchFirst

CVE-2026-45577

CVE-2026-45577 · Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolve unauthenticated requests as the local development user, making the hosted Inspector and related API surface reachable without credentials. This vulnerability is fixed in 0.11.1.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • neotoma

    Versions
    • >= 0.6.0, < 0.11.1: Affected

    No fix published

  • neotoma npm

    Affected ranges
    • SEMVER: ≥ 0.6.0, < 0.11.1

    Update to 0.11.1

Original sources

Check your server →