---
id: "CVE-2026-59179"
kind: "vulnerability"
aliases: ["CVE-2026-59179"]
title: "OpenHop: unauthenticated path traversal reads and deletes YAML files"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["docker", "node", "openhop", "package", "self-hosted"]
not_affected_if: ["loopback-only-no-browser-access", "version-0.3.7-or-later"]
published_at: "2026-10-28T14:17:04+00:00"
first_seen_at: "2026-10-28T14:33:23+00:00"
updated_at: "2026-10-28T14:34:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59179", "first_seen_at": "2026-10-28T14:33:23+00:00"}]
---

# OpenHop: unauthenticated path traversal reads and deletes YAML files

OpenHop's server takes a flow id from the URL and joins it into a file path without checking it, so an unauthenticated request can use traversal to read YAML files outside the flow directory or delete them. CORS is open to any origin, so a malicious webpage can also reach a server bound to localhost.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `@openhop/server` version (`npm ls @openhop/server`); versions before `0.3.7` are affected.
- Check whether the server is reachable from a network: look for `HOST=0.0.0.0` in the environment or Docker config.
- Confirm the flow directory setting and whether it sits next to other `.yaml` configuration files.

## Fix

- Upgrade `@openhop/server` to `0.3.7` or later.
- Until upgraded, do not expose the server beyond localhost and avoid Docker defaults of `HOST=0.0.0.0`.
- Back up YAML files outside the flow directory that the server could reach, and rotate any secrets stored in them if reads are suspected.

## Timeline

- 2026-10-28T14:33:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59179

## From the sources

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_