CVE-2026-63406

MediumCVSS 5.9

Published: 18/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

20th percentile - higher than 20% of all known CVEs

Summary

AnyCable before version 1.6.15 has a vulnerability in the telemetry subsystem that uses a hardcoded public auth token and generates a stable fingerprint from sensitive configuration data. Although raw credentials are not shown to leave the process, the fingerprint could be used for instance identification. Fixed in version 1.6.15.

Risk Assessment

Potential risk of configuration information disclosure and instance identification, which could facilitate further attacks.

Recommendation

Update AnyCable to version 1.6.15 or later. Consider disabling telemetry if not required.

Other vulnerabilities in AnyCable

CVE-2026-63405Medium
AnyCable before version 1.6.15 has a vulnerability in the Pusher-compatible REST API where the body_md5 value is included in HMAC but not verified against the actual request body. An attacker with a valid signed POST request can replace the body, and the lack of auth_timestamp freshness check allows replay attacks. This can lead to forged server events, state modification, or delivering attacker-controlled messages to WebSocket clients. Fixed in version 1.6.15.

Original NVD description (English source)

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory's claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS