{"uuid": "6f645bce-ba8e-4b86-b0b9-c432a211f226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108549", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417152569203933", "content": "CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108549https://github.com/chenhg5/cc-connect/issues/1968https://github.com/chenhg5/cc-connecthttps://github.com/chenhg5/cc-connect/blob/v1.5.0/platform/max/max.go#L287-L305https://www.vulncheck.com/advisories/cc-connect-through-1.5.0-missing-authentication-via-max-webhook-sender-spoofing#chenhg5 #cc-connect#CVE_2026_108549#bot", "creation_timestamp": "2026-10-10T14:46:03.870770Z"}