---
id: "CVE-2026-124587"
page: "https://infrastack.ai/live/CVE-2026-124587"
kind: "vulnerability"
aliases: ["CVE-2026-124587"]
title: "elizaOS Eliza: desktop app HTTP server leaks information to remote attackers"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ai-agents", "electrobun", "eliza", "elizaos", "other"]
not_affected_if: ["not-using-electrobun-desktop-app"]
published_at: "2026-11-09T10:17:08+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:26:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124587", "first_seen_at": "2026-11-09T10:25:49+00:00"}]
exploit_sources: []
---

# elizaOS Eliza: desktop app HTTP server leaks information to remote attackers

Link for people: https://infrastack.ai/live/CVE-2026-124587 (this .md is for agents)

A flaw in the Electrobun desktop app code of elizaOS Eliza 2.0.3-beta.7 lets a remote party reach an HTTP server component and read information it should not see. A public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Eliza checkout is at `2.0.3-beta.7` or earlier.
- Look at `packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts` and check whether it is included in your build.
- Check whether the Electrobun desktop app's HTTP server is reachable from other machines.

## Fix

- Apply the patch named in the NVD description: commit `cf6fa193017e70884e01c5bb7890f74b6b2b79d2`.
- No fixed release version is stated in the sources.

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124587

## Documents

- [fix] Patch: github.com https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2

## From the sources

A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_