{"id":"CVE-2026-118578","kind":"vulnerability","aliases":["CVE-2026-118578"],"related":[],"title":"MusicFreeDesktop: Request Forwarder flaw leaks information to local network","description":"A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"MusicFreeDesktop versions 0.0.6 through 0.0.8 have a flaw in an unspecified Request Forwarder function that discloses information. The sources say an exploit is public, but the project had not responded to an early report.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-app","musicfree-desktop","package"],"not_affected_if":["not-running-affected-versions"],"how_to_check":"- Check the installed MusicFreeDesktop version against `0.0.6`, `0.0.7` and `0.0.8`\n- unknown","fix":"- No fixed version is named in the sources; unknown\n- Upgrade to a release later than `0.0.8` once the maintainer publishes one, or stop running the desktop app on shared networks","status":"open","published_at":"2026-10-28T23:17:09+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","triaged_at":"2026-10-28T23:36:44+00:00","updated_at":"2026-10-28T23:36:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T23:36:44Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources; unknown\n- Upgrade to a release later than `0.0.8` once the maintainer publishes one, or stop running the desktop app on shared networks","reach":"network","title":"MusicFreeDesktop: Request Forwarder flaw leaks information to local network","impact":"low","summary":"MusicFreeDesktop versions 0.0.6 through 0.0.8 have a flaw in an unspecified Request Forwarder function that discloses information. The sources say an exploit is public, but the project had not responded to an early report.","category":"package","nicknames":[],"who_cares":["musicfree-desktop","desktop-app"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker on local network reads information the forwarder exposes","analyst_note":"Find the fixed version and the exact disclosed data in the upstream issue or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118578.","how_to_check":"- Check the installed MusicFreeDesktop version against `0.0.6`, `0.0.7` and `0.0.8`\n- unknown","needs_analyst":true,"not_affected_if":["not-running-affected-versions"],"who_is_affected":"Installations of MusicFreeDesktop 0.0.6, 0.0.7 or 0.0.8 are in scope, and the attack needs a position on the local network. The sources do not describe which data is disclosed or which configuration is required. Teams that do not run this desktop music player can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3358,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118578':12A,15A '-2026':11A,14A '/0.0.7/0.0.8':67C '0.0.6':25B,66C '0.0.8':27B 'affect':69C 'app':18B 'attack':87C,109C 'compon':77C 'cve':10A,13A 'desktop':17B,21B 'desktop-app':16B 'disclos':38B 'disclosur':85C 'discov':62C 'earli':55B,117C 'element':70C 'exploit':44B,97C 'flaw':4A,30B,59C 'forward':3A,35B,79C 'function':36B,74C 'inform':6A,39B,84C,113C 'issu':120C 'leak':5A 'local':8A,94C 'manipul':81C 'maotoumao':64C 'may':105C 'musicfre':20B 'musicfree-desktop':19B 'musicfreedesktop':1A,23B,65C 'network':9A,95C 'packag':22B 'perform':91C 'problem':116C 'project':49B,111C 'public':46B,103C 'releas':100C 'report':56B,121C 'request':2A,34B,78C 'respond':52B,125C 'result':82C 'say':42B 'secur':58C 'sourc':41B 'unknown':73C 'unspecifi':33B 'use':107C 'version':24B 'yet':126C","nicknames":[],"mitigations":[],"who_affected":"Installations of MusicFreeDesktop 0.0.6, 0.0.7 or 0.0.8 are in scope, and the attack needs a position on the local network. The sources do not describe which data is disclosed or which configuration is required. Teams that do not run this desktop music player can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T23:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118578","severity":null,"published_at":"2026-10-28T23:17:09+00:00","modified_at":"2026-10-28T23:17:09+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","fetched_at":"2026-10-28T23:35:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}