CVE-2026-76760
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute arbitrary code, potentially leading to system integrity compromise or data theft.
Recommendation
Update cc-connect to the latest version or apply available security patches.
Other vulnerabilities in cc-connect
See all- CVE-2026-108549High
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode. When no webhook_secret is configured, remote attackers can send unauthenticated updates to port 8080 and spoof an allowed or admin user_id to run privileged commands like /shell on the host.
- CVE-2026-92801High
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
- CVE-2026-76761High
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS