CVE-2026-86543

Critical

Description

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

SeverityCritical

CVSS9.8

Exploit probability—

ProductKnowns

PublishedSep 7, 2026

First seenSep 7, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

knowns-dev knowns0.30.0 or later

Patches

github.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fb

Vendor advisories

Affected products

Product	Affected versions	Fixed in
knowns-dev knowns	v < 0.30.0	0.30.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.