---
id: CVE-2026-105486
title: A vulnerability was detected in OSSRS srs up to 7.0-a1
summary: >-
  A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the
  function systemAPI.Run of the file internal/proxy/api.go of the component
  System API. Performing a manipulation results in missing authentication. It is
  possible to…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-287
  - CWE-306
vendor: OSSRS
product: srs
affected:
  - srs 7.0-a1
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T02:17:04.213'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105486'
references:
  - url: 'https://github.com/ossrs/srs/'
    label: cna@vuldb.com
  - url: >-
      https://github.com/ossrs/srs/commit/bb5fde228f4ca5bd26d96368b61f6e0c21df51df
    label: cna@vuldb.com
  - url: 'https://github.com/ossrs/srs/issues/4690'
    label: cna@vuldb.com
  - url: 'https://github.com/ossrs/srs/pull/4726'
    label: cna@vuldb.com
  - url: 'https://github.com/ossrs/srs/releases/tag/v8.0-d0'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-105486'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/986193'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413620'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413620/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-06T05:47:09.318Z'
---

## Overview

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.