CVE-2026-59148

HighCVSS 8.8

Published: 09/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

A vulnerability in Mockoon prior to 9.7.0 allows an unauthenticated attacker to remotely read MOCKOON_* environment variables, write arbitrary process environment variables, modify mock API response bodies, read transaction logs, and purge application state via the admin API, which is enabled by default and requires no authentication.

Risk Assessment

The risk for the organization includes leakage of sensitive configuration data (environment variables), potential takeover of mock API responses, and possible exposure of application data through transaction logs.

Recommendation

Update Mockoon to version 9.7.0 or later immediately. If an update is not possible, disable the admin API or restrict access to it using a firewall.

Other vulnerabilities in Mockoon

CVE-2026-59149Medium
A vulnerability in Mockoon prior to version 9.7.0 allows an unauthenticated client to read files outside the served directory. The issue stems from an improper path check in the getSafeFilePath function that lacks a path-separator boundary, enabling bypass via ../ sequences.

Original NVD description (English source)

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.