Live › vulnerability › CVE-2026-59179
Go to dashboardOpenHop's server takes a flow id from the URL and joins it into a file path without checking it, so an unauthenticated request can use traversal to read YAML files outside the flow directory or delete them. CORS is open to any origin, so a malicious webpage can also reach a server bound to localhost.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Teams running OpenHop's @openhop/server before 0.3.7 are exposed. Exposure is worst on Docker deployments that bind to all interfaces, where no authentication is needed to reach the flow routes; loopback-only instances are still reachable through a malicious webpage thanks to the CORS setting.
No product ranges from the sources yet.
@openhop/server version (npm ls @openhop/server); versions before 0.3.7 are affected.HOST=0.0.0.0 in the environment or Docker config..yaml configuration files.@openhop/server to 0.3.7 or later.HOST=0.0.0.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, @openhop/server passes unauthenticated flow route parameters from GET /api/flows/:id and DELETE /api/flows/:id in packages/server/src/routes.ts to FlowStore.filePath() in packages/server/src/store.ts without an identifier allow-list. The router applies decodeURIComponent to the id, and path.join() then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In packages/server/src/index.ts, CORS origin: true permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to HOST=0.0.0.0 and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-59179")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.