{"vulnerability": "CVE-2026-108753", "sightings": [{"uuid": "05483b2b-11f5-4197-b299-cca032daa54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108753", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422419590001954", "content": "CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108753https://hackmd.io/@haind/agnai-selfhost-compose-hardcoded-admin-jwt-secrethttps://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/self-host.docker-compose.yml#L18-L26https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/README.md#L75-L82https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/srv/api/auth.ts#L11-L14https://github.com/agnaistic/agnaihttps://www.vulncheck.com/advisories/agnaistic-agnai-through-1.0.555-hard-coded-credentials-in-self-host-docker-compose#agnaistic #agnai#CVE_2026_108753#bot", "creation_timestamp": "2026-10-11T13:05:32.183096Z"}, {"uuid": "dc74652f-43b4-4408-93aa-1133637c2e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108753", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxm3scesov2r", "content": "CVE-2026-108753 - agnai\nThe self\u2011hosted Docker setup for Agnai includes a fixed admin password and a public token secret. Because these values are hard\u2011coded, anyone can log in as an administrator, change\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#agnai #agnaistic #CVE #infosec", "creation_timestamp": "2026-10-11T13:20:11.438833Z"}, {"uuid": "fa2a14fb-1819-4f6c-881a-2f3267e694e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108753", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117422517486521728", "content": "CVE-2026-108753 | agnaistic agnai \u22641.0.555: CRITICAL hard-coded admin creds in docker-compose enable full admin compromise. Restrict config file access & monitor for abuse. Patch status unconfirmed. https://radar.offseq.com/threat/cve-2026-108753-use-of-hard-coded-credentials-in-agnaistic-agnai-58e8164af214c753 #OffSeq #CVE2026108753 #infosec #vuln", "creation_timestamp": "2026-10-11T13:30:26.395102Z"}, {"uuid": "aae5ec9a-3dc7-46ae-868b-dd2aaeafe707", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108753", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxm4etqlto2y", "content": "agnaistic agnai \u22641.0.555 is impacted by a CRITICAL hard-coded credentials flaw (CVE-2026-108753) in docker-compose config. Full admin access possible. Restrict config files & check vendor for fixes. https://radar.offseq.com/threat/cve-2026-108753-use-of-hard-coded-credentials-in-agnaistic-agnai-5...", "creation_timestamp": "2026-10-11T13:30:28.251970Z"}, {"uuid": "2b4d0058-ae4a-4a29-9643-2c51fb410699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108753", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxm6gmdjtb2l", "content": "\ud83d\udea8 CVE-2026-108753 \u2014 CVSS 9.3 CRITICAL\n\nAgnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108753\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-11T14:07:14.568110Z"}]}