{"uuid": "05483b2b-11f5-4197-b299-cca032daa54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108753", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422419590001954", "content": "CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108753https://hackmd.io/@haind/agnai-selfhost-compose-hardcoded-admin-jwt-secrethttps://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/self-host.docker-compose.yml#L18-L26https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/README.md#L75-L82https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/srv/api/auth.ts#L11-L14https://github.com/agnaistic/agnaihttps://www.vulncheck.com/advisories/agnaistic-agnai-through-1.0.555-hard-coded-credentials-in-self-host-docker-compose#agnaistic #agnai#CVE_2026_108753#bot", "creation_timestamp": "2026-10-11T13:05:32.183096Z"}