Live › vulnerability › CVE-2026-111617
Go to dashboardWHartTest through 2.8.1 accepts WebSocket connections on its UI endpoints without checking identity. An unauthenticated attacker can read other users' test-case payloads and step results, and inject spoofed results and screen frames into victim sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run WHartTest's web UI and expose its WebSocket endpoints beyond a trusted machine or network are exposed, because the consumer accepts every connection without authentication. Teams that run it only on a local workstation with no network exposure are at much lower risk. The sources do not say whether a default configuration enables these endpoints.
No product ranges from the sources yet.
2.8.1 or earlier./ws/ui/web/ and /ws/ui/actuator/ endpoints are reachable from untrusted networks.UiAutomationConsumer in the WHartTest source for an authentication check on WebSocket connect.2.8.1 once a fixed release is published; the sources do not name a fixed version./ws/ui/web/ and /ws/ui/actuator/ at the reverse proxy or firewall.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-111617")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.