High severity8.1NVD Advisory· Published Oct 10, 2026· Updated Oct 10, 2026

CVE-2026-108549

Description

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Chenhg5/Cc Connectllm-fuzzy
Range: <=1.5.0

Patches

Vulnerability mechanics

References

github.com/chenhg5/cc-connect/blob/v1.5.0/platform/max/max.gonvd
github.com/chenhg5/cc-connect/issues/1968nvd
www.vulncheck.com/advisories/cc-connect-through-1.5.0-missing-authentication-via-max-webhook-sender-spoofingnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000