{"id":"CVE-2026-124587","kind":"vulnerability","aliases":["CVE-2026-124587"],"related":[],"title":"elizaOS Eliza: desktop app HTTP server leaks information to remote attackers","description":"A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.","summary":"A flaw in the Electrobun desktop app code of elizaOS Eliza 2.0.3-beta.7 lets a remote party reach an HTTP server component and read information it should not see. A public exploit exists.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","electrobun","eliza","elizaos","other"],"not_affected_if":["not-using-electrobun-desktop-app"],"how_to_check":"- Confirm the Eliza checkout is at `2.0.3-beta.7` or earlier.\n- Look at `packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts` and check whether it is included in your build.\n- Check whether the Electrobun desktop app's HTTP server is reachable from other machines.","fix":"- Apply the patch named in the NVD description: commit `cf6fa193017e70884e01c5bb7890f74b6b2b79d2`.\n- No fixed release version is stated in the sources.","status":"open","published_at":"2026-11-09T10:17:08+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:35+00:00","updated_at":"2026-11-09T10:26:35+00:00","category":"other","confidence":0.55,"triage":{"at":"2026-11-09T10:26:35Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch named in the NVD description: commit `cf6fa193017e70884e01c5bb7890f74b6b2b79d2`.\n- No fixed release version is stated in the sources.","reach":"internet","title":"elizaOS Eliza: desktop app HTTP server leaks information to remote attackers","impact":"medium","summary":"A flaw in the Electrobun desktop app code of elizaOS Eliza 2.0.3-beta.7 lets a remote party reach an HTTP server component and read information it should not see. A public exploit exists.","audience":"developers","category":"other","nicknames":[],"who_cares":["eliza","elizaos","electrobun","ai-agents"],"confidence":0.55,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker reads information the HTTP server exposes","analyst_note":"Check the NVD and GitHub advisory for the affected endpoint, the authentication requirement and the release that includes commit cf6fa193017e70884e01c5bb7890f74b6b2b79d2.","how_to_check":"- Confirm the Eliza checkout is at `2.0.3-beta.7` or earlier.\n- Look at `packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts` and check whether it is included in your build.\n- Check whether the Electrobun desktop app's HTTP server is reachable from other machines.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-using-electrobun-desktop-app"],"who_is_affected":"The flaw is in the Electrobun desktop app's lifecycle code, which runs an HTTP server for the app. Teams running the Eliza desktop app, or building from that path, should look at it. Teams using only the agent libraries or a hosted deployment without the Electrobun app can likely skip it, but the sources do not confirm that.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001368,"input_tokens":4633,"output_tokens":1810,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124587':14A,17A '-2026':13A,16A '2.0.3':35B,64C 'affect':67C 'agent':20B 'ai':19B 'ai-ag':18B 'app':4A,30B 'appli':116C 'attack':11A,94C 'avail':100C 'beta.7':36B,65C 'cf6fa193017e70884e01c5bb7890f74b6b2b79d2':111C 'code':31B 'compon':45B,79C 'cve':12A,15A 'desktop':3A,29B 'disclosur':87C 'electrobun':21B,28B 'element':68C 'eliza':2A,22B,34B,63C 'elizao':1A,23B,33B,62C 'exist':56B 'exploit':55B,97C 'file':75C 'flaw':25B 'function':72C 'http':5A,43B,80C 'identifi':60C 'inform':8A,48B,86C 'issu':120C 'launch':92C 'lead':84C 'leak':7A 'let':37B 'manipul':83C 'might':102C 'name':106C 'packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts':76C 'parti':40B 'patch':109C,113C 'possibl':90C 'public':54B,99C 'reach':41B 'read':47B 'remedi':118C 'remot':10A,39B,95C 'see':52B 'server':6A,44B,81C 'unknown':71C 'use':104C 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the Electrobun desktop app's lifecycle code, which runs an HTTP server for the app. Teams running the Eliza desktop app, or building from that path, should look at it. Teams using only the agent libraries or a hosted deployment without the Electrobun app can likely skip it, but the sources do not confirm that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","electrobun","eliza","elizaos","medium","other"],"campaign_type":null,"search_a":"'-124587':14A,17A '-2026':13A,16A 'app':4A 'attack':11A 'cve':12A,15A 'desktop':3A 'eliza':2A 'elizao':1A 'http':5A 'inform':8A 'leak':7A 'remot':10A 'server':6A","search_b":"'2.0.3':35B 'agent':20B 'ai':19B 'ai-ag':18B 'app':30B 'beta.7':36B 'code':31B 'compon':45B 'desktop':29B 'electrobun':21B,28B 'eliza':22B,34B 'elizao':23B,33B 'exist':56B 'exploit':55B 'flaw':25B 'http':43B 'inform':48B 'let':37B 'parti':40B 'public':54B 'reach':41B 'read':47B 'remot':39B 'see':52B 'server':44B","search_c":"'2.0.3':64C 'affect':67C 'appli':116C 'attack':94C 'avail':100C 'beta.7':65C 'cf6fa193017e70884e01c5bb7890f74b6b2b79d2':111C 'compon':79C 'disclosur':87C 'element':68C 'eliza':63C 'elizao':62C 'exploit':97C 'file':75C 'function':72C 'http':80C 'identifi':60C 'inform':86C 'issu':120C 'launch':92C 'lead':84C 'manipul':83C 'might':102C 'name':106C 'packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts':76C 'patch':109C,113C 'possibl':90C 'public':99C 'remedi':118C 'remot':95C 'server':81C 'unknown':71C 'use':104C 'vulner':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124587","severity":null,"published_at":"2026-11-09T10:17:08+00:00","modified_at":"2026-11-09T10:17:09+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null}],"documents":[{"id":106901,"url":"https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}