All vulnerabilities
CVE-2026-108549

cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

chenhg5 cc-connect
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published10 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

Text from CVE List

Affected versions 1

  • cc-connectaffected: all versions through 1.5.0CVE List

References 4