Threat Investigation
Request a demo

CVE-2026-13140

Low

Description

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

SeverityLow
CVSS1.1
Exploit probability—
ProductCanarytokens
PublishedJun 24, 2026
First seenJun 24, 2026
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • Thinkst Applied Research Canarytokensf5aa5c4e or later

Affected products

ProductAffected versionsFixed in
Thinkst Applied Research Canarytokenssha-4116b92cb ≤ v < f5aa5c4e, 4116b92cb ≤ v < f5aa5c4ef5aa5c4e

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.