Description
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nullclaw NullHub
Default version status: unaffected
0 to ≤ 2026.5.29affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg ↗
- https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig#L546-L556 ↗
- https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig#L29-L54 ↗
- https://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile#L69-L71 ↗
- https://github.com/nullclaw/nullhub ↗
- https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api ↗