CVE-2026-108549
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode. When no webhook_secret is configured, remote attackers can send unauthenticated updates to port 8080 and spoof an allowed or admin user_id to run privileged commands like /shell on the host.
Risk Assessment
The risk is critical because an unauthenticated attacker can take over the host by executing arbitrary commands with elevated privileges, potentially leading to full system compromise.
Recommendation
Immediately configure a webhook_secret for the MAX adapter and update cc-connect to the latest version if available. Additionally, restrict access to port 8080 to trusted sources only.
Other vulnerabilities in cc-connect
See all- CVE-2026-92801High
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
- CVE-2026-76761High
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.
- CVE-2026-76760High
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.
Original NVD description (English source)
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS