Live › vulnerability › CVE-2026-18516
Go to dashboardCrafty Controller trusts client-supplied X-Real-IP / X-Forwarded-For as the remote IP. A failed login for an existing username stores that value in the activity (audit) log, and the Activity Logs page inserts it into the DOM as HTML. An unauthenticated attacker gets stored XSS that runs when a superuser opens the page. The project's own report chains it to a full-access API key, a changed server start command and command execution as the OS user running Crafty. The victim must be a superuser who opens Activity Logs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Crafty Controller | other | <= 4.10.8 | 4.11.0 |
4.10.8 is affected4.11.0 or later (released 2026-09-16)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
This page as .md · .json · in your agent: get_signal("CVE-2026-18516")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.