{"vulnerability": "cve-2026-59148", "sightings": [{"uuid": "12dfc238-3ff6-424f-a0bf-d035bc26fa52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59148", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqaibfx7pc24", "content": "CVE-2026-59148 - Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft\nCVE ID : CVE-2026-59148\n \n Published : July 9, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mock...", "creation_timestamp": "2026-07-09T20:34:59.349479Z"}, {"uuid": "b5663bbf-6b07-44e2-a70a-e9fc0de30070", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59148", "type": "seen", "source": "https://gist.github.com/alon710/12e5af59440fe17bf499cbab29b7b498", "content": "# CVE-2026-59148: CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59148\n\n## Summary\nAn in-depth analysis of CVE-2026-59148, a high-severity flaw in Mockoon where unauthenticated administrative endpoints and a wildcard Cross-Origin Resource Sharing (CORS) policy allow remote execution, state poisoning, and credential theft.\n\n## TL;DR\nUnauthenticated endpoints and wildcard CORS in Mockoon allow local and remote attackers to compromise administrative APIs and hijack local server instances.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-942, CWE-732, CWE-352\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.8 (High)\n- **EPSS Score**: 0.00262 (0.26% probability)\n- **Impact**: Remote Code Execution / Environment Pollution / Credential Exfiltration\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mockoon Desktop Client\n- Mockoon CLI\n- Mockoon Serverless\n- @mockoon/commons-server\n- **Mockoon**: < 9.7.0 (Fixed in: `9.7.0`)\n\n## Mitigation\n\n- Upgrade Mockoon components to version 9.7.0 or above\n- Disable the administrative API using application flags\n- Restrict socket binding to localhost (127.0.0.1)\n- Use firewalls to block remote inbound connections to mock ports\n\n**Remediation Steps:**\n1. Identify all active instances of Mockoon CLI, GUI, and Serverless libraries.\n2. Execute update commands to pull version 9.7.0 or newer.\n3. Set the MOCKOON_ADMIN_API_TOKEN environment variable to a strong, random value.\n4. Ensure the --disable-admin-api flag is configured for CLI execution where the administration plane is not needed.\n5. Verify localhost-only binding in environment configurations.\n\n## References\n\n- [GHSA-rqx4-3f6q-3x2v](https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v)\n- [Security Patch Commit](https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299)\n- [Security Patch Pull Request](https://github.com/mockoon/mockoon/pull/2254)\n- [Release v9.7.0](https://github.com/mockoon/mockoon/releases/tag/v9.7.0)\n- [Mockoon Official Release Notes](https://mockoon.com/releases/9.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59148) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T00:32:03.846589Z"}, {"uuid": "4821e08a-11e8-4db6-8391-f0df2e00c89e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59148", "type": "published-proof-of-concept", "source": "https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v", "content": "", "creation_timestamp": "2026-09-12T00:35:05.840754Z"}]}