Live › vulnerability › CVE-2026-114397
Go to dashboardTrudesk through 1.2.11 exposes debug routes whenever NODE_ENV is unset, with no authentication required. An attacker can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts that use the password 'password'.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Trudesk install through 1.2.11 where the NODE_ENV environment variable is not set is exposed, since the debug routes are enabled by default in that state. Installs that were populated with the seed data and still use the default accounts are also at risk of takeover. Instances that set NODE_ENV=production and are not reachable from the internet are less exposed.
No product ranges from the sources yet.
NODE_ENV is set in the Trudesk process environment; if it is unset, the debug routes are enabled./debug/populatedb on the Trudesk host; a response instead of a 404 means the routes are reachable.npm ls trudesk or the package.json in the install directory, versions 1.2.11 and earlier are affected.1.2.11; the sources do not name the fixed release, so check the project's releases.NODE_ENV=production for the Trudesk process to disable the debug routes as a workaround.password./debug/ paths at the reverse proxy until the upgrade is done.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.
This page as .md · .json · in your agent: get_signal("CVE-2026-114397")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.