{"id":"CVE-2026-18516","kind":"vulnerability","aliases":["CVE-2026-18516"],"related":[],"title":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated…","description":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection","summary":"Crafty Controller trusts client-supplied X-Real-IP / X-Forwarded-For as the remote IP. A failed login for an existing username stores that value in the activity (audit) log, and the Activity Logs page inserts it into the DOM as HTML. An unauthenticated attacker gets stored XSS that runs when a superuser opens the page. The project's own report chains it to a full-access API key, a changed server start command and command execution as the OS user running Crafty. The victim must be a superuser who opens Activity Logs.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Crafty Controller","fixed":["4.11.0"],"affected":"<= 4.10.8","ecosystem":"other"}],"ecosystems":[],"tags":["crafty-controller","minecraft","other","self-hosted","xss"],"not_affected_if":["not-crafty-controller","version-4.11.0-or-later"],"how_to_check":"Check the Crafty version (shown in the panel footer or config). Anything at or below 4.10.8 is affected. Exposed if the panel is reachable by untrusted networks, especially without a reverse proxy that overwrites X-Real-IP and X-Forwarded-For. Look at Activity Logs for failed-login entries whose IP field contains HTML or script (e.g. '<').","fix":"Upgrade to Crafty Controller 4.11.0 or later (released 2026-09-16). Workaround from the CVE record: put Crafty behind a reverse proxy that blocks or overwrites client-supplied X-Real-IP and X-Forwarded-For, and restrict panel access to trusted networks. If you suspect exposure, review API keys and server start commands for unexpected changes.","status":"open","published_at":"2026-10-16T14:17:24+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:06:59+00:00","updated_at":"2026-10-23T23:33:12+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:06:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"Crafty Controller, a web panel for managing Minecraft servers, fails to escape values in its Audit Logs, so injected HTTP header content is stored and rendered as script. An unauthenticated remote attacker can run JavaScript in the browser of anyone who views the audit log, which can include an administrator.","category":"other","who_cares":["crafty-controller","self-hosted","minecraft"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs scripts in an admin's browser, possibly taking over the panel","analyst_note":"Find the affected Crafty Controller version range and fixed release in the NVD entry or the upstream project advisory; the sources give no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-crafty-controller"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000442,"input_tokens":2725,"output_tokens":339,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected Crafty Controller version range and fixed release in the NVD entry or the upstream project advisory; the sources give no versions.","search":"'-18516':19A,22A '-2026':18A,21A 'access':104B 'activ':64B,69B,129B 'allow':13A,143C 'api':105B 'attack':81B,147C 'audit':7A,65B,137C 'chain':98B 'chang':108B 'client':38B 'client-suppli':37B 'command':111B,113B 'compon':9A,139C 'control':12A,27B,35B,142C 'controller':24A 'crafti':11A,26B,34B,120B,141C 'crafty':23A 'crafty-control':25B 'cross':152C 'cross-sit':151C 'cve':17A,20A 'dom':76B 'escap':3A,133C 'execut':114B 'exist':57B 'fail':53B 'forward':46B 'full':103B 'full-access':102B 'get':82B 'header':157C 'host':32B 'html':78B 'http':156C 'inject':158C 'insert':72B 'ip':43B,51B 'key':106B 'log':8A,66B,70B,130B,138C 'login':54B 'minecraft':28B 'must':123B 'open':90B,128B 'os':117B 'output':2A,132C 'page':71B,92B 'perform':149C 'project':94B 'real':42B 'remot':15A,50B,145C 'report':97B 'run':86B,119B 'script':154C 'self':31B 'self-host':30B 'server':109B 'site':153C 'start':110B 'store':59B,83B,150C 'superus':89B,126B 'suppli':39B 'trust':36B 'unauthent':16A,80B,146C 'user':118B 'usernam':58B 'valu':61B 'via':155C 'victim':122B 'vulner':4A,134C 'x':41B,45B 'x-forwarded-for':44B 'x-real-ip':40B 'xss':33B,84B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18516","severity":null,"published_at":"2026-10-16T14:17:24+00:00","modified_at":"2026-10-18T14:16:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18516:465","url":null,"severity":null,"published_at":"2026-10-23T23:33:12+00:00","modified_at":"2026-10-23T23:33:12+00:00","first_seen_at":"2026-10-23T23:33:12+00:00","fetched_at":"2026-10-23T23:33:12+00:00","note":"Read the project's GitLab issue #743 (report, confirmed on 4.10.7) and the 4.11.0 changelog, which names this CVE. The affected range 'through 4.10.8' comes from secnews.gr and AcidPeak, which cite NVD/CNA, not from a vendor page. No in-the-wild exploitation and no public PoC beyond the issue write-up. Skipped X search."}],"documents":[{"id":2038,"url":"https://gitlab.com/crafty-controller/crafty-4/-/work_items/743","title":"Pre-auth stored XSS in Activity Logs can lead to command execution (#743)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2039,"url":"https://gitlab.com/crafty-controller/crafty-4/-/blob/master/CHANGELOG.md","title":"Crafty 4 changelog, 4.11.0","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2040,"url":"https://www.acidpeak.com/threats/cve-2026-18516/","title":"AcidPeak: CVE-2026-18516 (quotes CVE record solution)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}