---
id: "CVE-2026-118578"
kind: "vulnerability"
aliases: ["CVE-2026-118578"]
title: "MusicFreeDesktop: Request Forwarder flaw leaks information to local network"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop-app", "musicfree-desktop", "package"]
not_affected_if: ["not-running-affected-versions"]
published_at: "2026-10-28T23:17:09+00:00"
first_seen_at: "2026-10-28T23:35:49+00:00"
updated_at: "2026-10-28T23:36:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118578", "first_seen_at": "2026-10-28T23:35:49+00:00"}]
---

# MusicFreeDesktop: Request Forwarder flaw leaks information to local network

MusicFreeDesktop versions 0.0.6 through 0.0.8 have a flaw in an unspecified Request Forwarder function that discloses information. The sources say an exploit is public, but the project had not responded to an early report.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MusicFreeDesktop version against `0.0.6`, `0.0.7` and `0.0.8`
- unknown

## Fix

- No fixed version is named in the sources; unknown
- Upgrade to a release later than `0.0.8` once the maintainer publishes one, or stop running the desktop app on shared networks

## Timeline

- 2026-10-28T23:35:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118578

## From the sources

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_