Live › vulnerability › CVE-2026-116485
Go to dashboarddanmu_api before 1.21.7 accepts POST requests to its env set, add and delete endpoints when the default TOKEN is in use and ADMIN_TOKEN is unset. An unauthenticated attacker can set ADMIN_TOKEN to lock out operators, redirect OTHER_SERVER or PROXY_URL to enable SSRF, and trigger redeployment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Instances running danmu_api before 1.21.7 with the default TOKEN and no ADMIN_TOKEN set are exposed to unauthenticated requests to the env endpoints. Systems that were already patched or that set a custom ADMIN_TOKEN are less exposed. Teams not running danmu_api can skip it.
No product ranges from the sources yet.
1.21.7ADMIN_TOKEN environment variable is set on the running instanceTOKEN1.21.7 or laterADMIN_TOKEN and rotate TOKEN if the instance was exposed before patchingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
This page as .md · .json · in your agent: get_signal("CVE-2026-116485")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.