A default-configuration flaw in the knowns package exposes its management API without authentication on all network interfaces, letting any attacker who can reach the listening port take control of an instance and republish its API to a public address.
What Is It
CVE-2026-86543 is a missing-authentication vulnerability (CWE-306) in knowns versions before 0.30.0. Affected builds serve the management API on all network interfaces by default, and fresh installations require no password at all. That leaves the full management surface reachable by anyone who can route a packet to the listening port.
The specific abuse path called out in the advisory is the unauthenticated /api/tunnel/start endpoint. An attacker can call it to provision a public tunnel, which republishes the same unauthenticated API at a publicly accessible address; converting an exposure that was previously confined to the local network into an internet-facing one without ever authenticating.
Why It Matters
The issue carries a CVSS v3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a secondary CVSS v4.0 score of 9.3 (Critical). Every exploitability dial is set the wrong way: network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability alike.
The tunnel-provisioning behavior is what elevates this beyond a typical default-binding mistake. A single unauthenticated request changes the exposure of that instance persistently: an attacker who reaches it once from the local network can leave it publicly addressable afterward. Nothing described in the advisory spreads from one instance to another; the effect is confined to the instance that was contacted, but it outlives the attacker's initial access.
The supplied source material does not document any confirmed in-the-wild exploitation, and exploit maturity in the CVSS v4.0 vector is undefined.
What's Vulnerable
- Vendor: knowns-dev
- Product: knowns (
pkg:npm/knowns) - Affected: all versions from 0 up to, but not including, 0.30.0 (semver)
- Unaffected: 0.30.0 and later
- Default status for versions outside that range is unaffected. No CPE entries are listed in the NVD record.
Patch Status
Version 0.30.0 is the fixed release and is marked unaffected. Upgrade to 0.30.0 or later. The fix is tracked in commit 878a02c and documented in GitHub Security Advisory GHSA-fc85-99vc-9c75. Vulnerable code paths referenced by the reporter sit in internal/server/auth.go, internal/server/routes/tunnel.go, and internal/cli/browser.go as of v0.29.1.
The record was published 2026-09-07 by VulnCheck and remains in Received status, so NVD enrichment may still change.
Sources
- NVD, CVE-2026-86543: https://nvd.nist.gov/vuln/detail/CVE-2026-86543
- VulnCheck Advisory: https://www.vulncheck.com/advisories/knowns-before-0.30.0-unauthenticated-management-api-exposure
- GitHub Security Advisory GHSA-fc85-99vc-9c75: https://github.com/knowns-dev/knowns/security/advisories/GHSA-fc85-99vc-9c75
- Fix commit 878a02c: https://github.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fb
- Release v0.30.0: https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
- Affected code,
internal/server/auth.go: https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go#L80-L86 - Affected code,
internal/server/routes/tunnel.go: https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/tunnel.go#L26-L38 - Affected code,
internal/cli/browser.go: https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go#L193-L200