Cyber & AI intelligence
Wasteland.
Briefs indexed2425
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85688 2026-09-04

CVE-2026-85688: Unauthenticated File Read/Write in TEN Framework TMAN Designer

"A critical (CVSS 9.8) pair of unauthenticated arbitrary file read and write flaws in TEN Framework 0.11.71 lets remote attackers pull sensitive files off the host and plant content that can lead to code execution."

A critical (CVSS 9.8) pair of unauthenticated arbitrary file read and write flaws in TEN Framework 0.11.71 lets remote attackers pull sensitive files off the host and plant content that can lead to code execution.

What Is It

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system paths. Writing to targets such as authorized_keys, cron files, or executable graph files can enable code execution on the affected host, depending on the deployment's file permissions and service configuration.

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), the file-content endpoints are reachable without any credentials.

Why It Matters

The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability factor is at its worst: network-reachable, low attack complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. A secondary CVSS 4.0 score of 9.3 (CRITICAL) reports the same profile with no attack requirements.

In practice, an attacker who can reach the endpoint should be assumed capable of reading sensitive files from disk with a single unauthenticated request, and of writing attacker-controlled content to a path that plausibly leads to persistence or command execution with a follow-up request. The exact impact depends on what the service account can read and where it can write on a given deployment. As of publication, CVE-2026-85688 does not appear in the CISA Known Exploited Vulnerabilities catalog (linked below), so active exploitation has not been confirmed by KEV; the catalog is the authoritative place to re-check that status.

What's Vulnerable

Patch Status

The NVD record was published 2026-09-04 with a vulnerability status of "Received," and neither the NVD entry nor the VulnCheck advisory listed below identifies a fixed version, patch, or vendor remediation deadline at the time of writing. Until a fixed release is confirmed, treat any exposed TMAN Designer endpoint as untrusted and restrict network access to it. Track the upstream GitHub issue linked below, and re-check the NVD record, for fix progress.

Sources