---
id: CVE-2026-110616
title: >-
  NullHub through 2026.5.29 contains a missing authentication vulnerability that
  allows unauthenticated attackers to access the /api/* management API because
  the auth_token field defaults to null and is never assigned
summary: >-
  NullHub through 2026.5.29 contains a missing authentication vulnerability that
  allows unauthenticated attackers to access the /api/* management API because
  the auth_token field defaults to null and is never assigned. Attackers sending
  re…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T15:17:13.767'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110616'
references:
  - url: 'https://github.com/nullclaw/nullhub'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile#L69-L71'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig#L29-L54
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig#L546-L556
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.007Z'
---

## Overview

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.