Live › vulnerability › CVE-2026-109823
Go to dashboardTidewave, a development tool, exposes the names of filesystem paths in its configuration endpoint and rendered toolbar without checking the Host header. A web page that rebinds its domain to the loopback address can read those paths, which usually reveal the local username and project layout.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Developers running the Tidewave development server on a machine with a version from 0.8.0 before 0.9.2. The sources describe a local loopback exposure through DNS rebinding, so the risk is limited to a developer's own workstation and not to deployed production systems. Teams that do not run Tidewave in development, or that already run 0.9.2 or later, can skip it.
No product ranges from the sources yet.
mix deps or the lockfile entry, and confirm whether it is 0.8.0 or later but before 0.9.2.0.9.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.
Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.
This issue affects tidewave: from 0.8.0 before 0.9.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-109823")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.