Live › vulnerability › CVE-2026-116679
Go to dashboardNeko is a self-hosted virtual browser that runs in Docker and streams over WebRTC. In versions 3.0.0 through 3.1.4, a host-check bug in legacy mode with implicit hosting lets an authenticated room member send mouse and keyboard input over the legacy data channel even when controls are locked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:32 UTC. All times on this page are UTC.
Teams running self-hosted Neko from 3.0.0 through 3.1.4 with legacy mode and session.implicit_hosting enabled. The flaw needs an authenticated room member who can open a WebRTC connection, so deployments that run with the default modern control API or with implicit hosting off are not exposed.
No product ranges from the sources yet.
3.1.4 or earlier means affectedlegacy mode and session.implicit_hosting enabled in the Neko configuration3.1.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-116679")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.