DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-59148: CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon

#security #cve #cybersecurity

CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon

Vulnerability ID: CVE-2026-59148
CVSS Score: 8.8
Published: 2026-09-11

An in-depth analysis of CVE-2026-59148, a high-severity flaw in Mockoon where unauthenticated administrative endpoints and a wildcard Cross-Origin Resource Sharing (CORS) policy allow remote execution, state poisoning, and credential theft.

TL;DR

Unauthenticated endpoints and wildcard CORS in Mockoon allow local and remote attackers to compromise administrative APIs and hijack local server instances.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-306, CWE-942, CWE-732, CWE-352
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.8 (High)
  • EPSS Score: 0.00262 (0.26% probability)
  • Impact: Remote Code Execution / Environment Pollution / Credential Exfiltration
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • Mockoon Desktop Client
  • Mockoon CLI
  • Mockoon Serverless
  • @mockoon/commons-server
  • Mockoon: < 9.7.0 (Fixed in: 9.7.0)

Exploit Details

Mitigation Strategies

  • Upgrade Mockoon components to version 9.7.0 or above
  • Disable the administrative API using application flags
  • Restrict socket binding to localhost (127.0.0.1)
  • Use firewalls to block remote inbound connections to mock ports

Remediation Steps:

  1. Identify all active instances of Mockoon CLI, GUI, and Serverless libraries.
  2. Execute update commands to pull version 9.7.0 or newer.
  3. Set the MOCKOON_ADMIN_API_TOKEN environment variable to a strong, random value.
  4. Ensure the --disable-admin-api flag is configured for CLI execution where the administration plane is not needed.
  5. Verify localhost-only binding in environment configurations.

References

Read the full report for CVE-2026-59148 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)