{"vulnerability": "CVE-2026-57443", "sightings": [{"uuid": "a180c86b-be9e-40ed-8bd6-5b0dd1e2a240", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57443", "type": "published-proof-of-concept", "source": "https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39", "content": "", "creation_timestamp": "2026-08-08T17:04:24.000000Z"}, {"uuid": "5e201697-ed56-481b-8afc-a75895c549e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57443", "type": "seen", "source": "https://gist.github.com/alon710/770bc93a95283bd19ea1ae1345262edc", "content": "# CVE-2026-57443: CVE-2026-57443: Unauthenticated Operations API Information Disclosure in SCBE-AETHERMOORE\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57443\n\n## Summary\nAn unauthenticated remote information disclosure vulnerability exists in the SCBE-AETHERMOORE geometric AI governance framework. The API endpoint `/api/ops/check-email` allows unauthenticated network actors to trigger administrative subprocesses and retrieve sensitive operator email digests from Gmail or ProtonMail mailboxes due to missing authentication controls and overly permissive CORS configurations.\n\n## TL;DR\nAn unauthenticated operations API endpoint in SCBE-AETHERMOORE allows remote attackers to execute a background email harvesting subprocess and retrieve sensitive operator email digests without credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Network\n- **Attack Complexity**: Low\n- **Privileges Required**: None\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SCBE-AETHERMOORE\n- **SCBE-AETHERMOORE**: >= 4.0.2, < 4.2.1 (Fixed in: `4.2.1`)\n\n## Mitigation\n\n- Upgrade SCBE-AETHERMOORE to version 4.2.1 or higher.\n- Set the SCBE_OPS_ADMIN_TOKEN environment variable to enforce authentication.\n- Configure the API server host to bind strictly to localhost (127.0.0.1) instead of 0.0.0.0.\n- Restrict the FastAPI CORS configuration to trusted domains only instead of wildcard '*'\n\n**Remediation Steps:**\n1. Identify running instances of SCBE-AETHERMOORE and determine the current version in use.\n2. Pull the latest framework updates or execute an upgrade to version 4.2.1 or newer.\n3. Generate a high-entropy secret token (e.g., openssl rand -hex 32).\n4. Export the token as an environment variable: export SCBE_OPS_ADMIN_TOKEN='your_secure_token'.\n5. Modify configuration files or startup scripts to bind the FastAPI app to localhost: python scripts/aetherbrowser/api_server.py --host 127.0.0.1.\n6. Restart the service to apply changes and verify that unauthenticated calls to /api/ops/check-email are blocked with a 403 or 401 status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-q986-4x7x-gx39](https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39)\n- [Fix Commit 1](https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e)\n- [Fix Commit 2](https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-57443)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57443) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T22:30:32.000000Z"}, {"uuid": "9889ccfd-58d1-4f94-9729-52dea3a9a715", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57443", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwexen24go2k", "content": "\ud83d\udfe0 CVE-2026-57443 - High (7.5)\n\nSCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-57443/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T23:47:02.988445Z"}]}