CVE-2026-124587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124587", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-08T20:33:37.496Z", "datePublished": "2026-11-09T09:30:27.977Z", "dateUpdated": "2026-11-09T22:36:09.304Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-09T09:30:27.977Z"}, "title": "elizaOS eliza HTTP Server api-base-owner.ts information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "elizaOS", "product": "eliza", "versions": [{"version": "2.0.3-beta.7", "status": "affected"}], "cpes": ["cpe:2.3:a:elizaos:eliza:*:*:*:*:*:*:*:*"], "modules": ["HTTP Server"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-11-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-08T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-08T21:38:42.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "akamoli (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/433011", "name": "VDB-433011 | elizaOS eliza HTTP Server api-base-owner.ts information disclosure", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/433011/cti", "name": "VDB-433011 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-124587", "name": "CVE-2026-124587 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1039543", "name": "Submit #1039543 | github.com/elizaOS eliza 2.0.3-beta.7 Local Sensitive Logic exposure lead to token leak", "tags": ["third-party-advisory"]}, {"url": "https://github.com/elizaOS/eliza/issues/33034", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/elizaOS/eliza/pull/33142", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2", "tags": ["patch"]}, {"url": "https://github.com/elizaOS/eliza/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T22:35:57.772173Z", "id": "CVE-2026-124587", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:36:09.304Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124587", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-08T20:33:37.496Z", "datePublished": "2026-11-09T09:30:27.977Z", "dateUpdated": "2026-11-09T22:36:09.304Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-09T09:30:27.977Z"}, "title": "elizaOS eliza HTTP Server api-base-owner.ts information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "elizaOS", "product": "eliza", "versions": [{"version": "2.0.3-beta.7", "status": "affected"}], "cpes": ["cpe:2.3:a:elizaos:eliza:*:*:*:*:*:*:*:*"], "modules": ["HTTP Server"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-11-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-08T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-08T21:38:42.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "akamoli (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/433011", "name": "VDB-433011 | elizaOS eliza HTTP Server api-base-owner.ts information disclosure", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/433011/cti", "name": "VDB-433011 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-124587", "name": "CVE-2026-124587 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1039543", "name": "Submit #1039543 | github.com/elizaOS eliza 2.0.3-beta.7 Local Sensitive Logic exposure lead to token leak", "tags": ["third-party-advisory"]}, {"url": "https://github.com/elizaOS/eliza/issues/33034", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/elizaOS/eliza/pull/33142", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2", "tags": ["patch"]}, {"url": "https://github.com/elizaOS/eliza/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-124587", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T22:35:57.772173Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:36:04.071Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:elizaos:eliza:*:*:*:*:*:*:*:*"], "modules": ["HTTP Server"], "product": "eliza", "vendor": "elizaOS", "versions": [{"status": "affected", "version": "2.0.3-beta.7"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue."}], "id": "CVE-2026-124587", "lastModified": "2026-11-09T23:17:20.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-124587", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T22:35:57.772173Z", "version": "2.0.3"}}]}, "published": "2026-11-09T10:17:08.950", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/elizaOS/eliza/"}, {"source": "cna@vuldb.com", "url": "https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2"}, {"source": "cna@vuldb.com", "url": "https://github.com/elizaOS/eliza/issues/33034"}, {"source": "cna@vuldb.com", "url": "https://github.com/elizaOS/eliza/pull/33142"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-124587"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1039543"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/433011"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/433011/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.3-beta.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "eliza", "source": "cna", "vendor": "elizaOS"}, "product": "eliza", "vendor": "elizaos"}], "created": "2026-11-09T10:30:09.041069+00:00", "updated": "2026-11-09T16:36:56.840751+00:00", "vendors": ["elizaos", "elizaos$PRODUCT$eliza"]}