CVE-2026-63406: Information Disclosure via Insecure Telemetry and Hardcoded Credentials in AnyCable-Go
Vulnerability ID: CVE-2026-63406
CVSS Score: 5.9
Published: 2026-09-18
CVE-2026-63406 is an information disclosure vulnerability in AnyCable-go prior to version 1.6.15. The built-in telemetry client is enabled by default with a hardcoded public authentication token ('secret'). This client digests highly sensitive configuration parameters and command-line arguments, including JWT secrets and RPC secrets, into a stable SHA-256 fingerprint. This fingerprint is sent over public networks, exposing those administrative secrets to offline dictionary and brute-force attacks if intercepted.
TL;DR
AnyCable-Go's default telemetry configuration used a public token and digested raw command-line secrets into an unsalted SHA-256 fingerprint, exposing administrative credentials to offline cracking if network traffic was captured.
Technical Details
- CWE ID: CWE-798, CWE-312
- Attack Vector: Network (AV:N)
- CVSS v3.1: 5.9 (Medium)
- EPSS Score: 0.0
- Exploit Status: Conceptual
- CISA KEV Status: Not Listed
Affected Systems
- AnyCable (anycable-go)
-
anycable-go: < 1.6.15 (Fixed in:
1.6.15)
Code Analysis
Commit: 201c67e
Disable telemetry by default and require build-time token configuration
Mitigation Strategies
- Upgrade AnyCable-Go to version 1.6.15 or newer
- Pass secrets via environment variables instead of command-line arguments
- Block outbound TCP connections to telemetry.anycable.io
Remediation Steps:
- Identify current AnyCable-Go version using 'anycable-go --version'
- Download and deploy version 1.6.15 or later
- Verify that the telemetry message 'Anonymized telemetry is on' is no longer displayed in the server logs
- If updating is delayed, migrate '--secret' and '--jwt_secret' flags to corresponding environment variables
References
Read the full report for CVE-2026-63406 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)