{"vulnerability": "CVE-2026-108549", "sightings": [{"uuid": "6f645bce-ba8e-4b86-b0b9-c432a211f226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108549", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417152569203933", "content": "CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108549https://github.com/chenhg5/cc-connect/issues/1968https://github.com/chenhg5/cc-connecthttps://github.com/chenhg5/cc-connect/blob/v1.5.0/platform/max/max.go#L287-L305https://www.vulncheck.com/advisories/cc-connect-through-1.5.0-missing-authentication-via-max-webhook-sender-spoofing#chenhg5 #cc-connect#CVE_2026_108549#bot", "creation_timestamp": "2026-10-10T14:46:03.870770Z"}, {"uuid": "6519a53c-429c-4d7c-91b1-e4eacb9a331d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108549", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxjt5opnlb2h", "content": "CVE-2026-108549 - cc-connect\nThe cc-connect software (versions up to 1.5.0) accepts messages on its webhook port without checking who sent them, if a secret key is not set. An attacker who can reach that\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ccconnect #chenhg5 #CVE #infosec", "creation_timestamp": "2026-10-10T15:40:04.536950Z"}, {"uuid": "e89accfe-0d18-4c3c-9450-2d4e859e6485", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108549", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxjunyt5zt24", "content": "\ud83d\udea8 CVE-2026-108549 \u2014 CVSS 9.2 CRITICAL\n\ncc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhoo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108549\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T16:07:05.898178Z"}, {"uuid": "109834e6-7c7c-4a60-b3be-3024aab97051", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108549", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxk2a5h5b72h", "content": "\ud83d\udfe0 CVE-2026-108549 - High (8.1)\n\ncc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adap...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108549/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T17:46:43.567492Z"}]}