CVE-2026-6874

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6874", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-22T18:20:59.444Z", "datePublished": "2026-04-22T23:30:14.104Z", "dateUpdated": "2026-04-23T14:32:39.599Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-22T23:30:14.104Z"}, "title": "ericc-ch copilot-api Header token dns rebinding", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-350", "lang": "en", "description": "Reliance on Reverse DNS Resolution"}]}], "affected": [{"vendor": "ericc-ch", "product": "copilot-api", "versions": [{"version": "0.1", "status": "affected"}, {"version": "0.2", "status": "affected"}, {"version": "0.3", "status": "affected"}, {"version": "0.4", "status": "affected"}, {"version": "0.5", "status": "affected"}, {"version": "0.6", "status": "affected"}, {"version": "0.7.0", "status": "affected"}], "modules": ["Header Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing a manipulation of the argument Host can lead to reliance on reverse dns resolution. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-22T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-22T20:26:05.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yu_Bao (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359039", "name": "VDB-359039 | ericc-ch copilot-api Header token dns rebinding", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359039/cti", "name": "VDB-359039 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/795212", "name": "Submit #795212 | ericc-ch copilot-api 0.7.0 DNS Rebinding Attack", "tags": ["third-party-advisory"]}, {"url": "https://github.com/August829/CVEP/issues/32", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T14:32:30.081126Z", "id": "CVE-2026-6874", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T14:32:39.599Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "ericc-ch copilot-api Header token dns rebinding", "credits": [{"lang": "en", "type": "reporter", "value": "Yu_Bao (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "ericc-ch", "modules": ["Header Handler"], "product": "copilot-api", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2"}, {"status": "affected", "version": "0.3"}, {"status": "affected", "version": "0.4"}, {"status": "affected", "version": "0.5"}, {"status": "affected", "version": "0.6"}, {"status": "affected", "version": "0.7.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-22T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-22T20:26:05.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359039", "name": "VDB-359039 | ericc-ch copilot-api Header token dns rebinding", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359039/cti", "name": "VDB-359039 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/795212", "name": "Submit #795212 | ericc-ch copilot-api 0.7.0 DNS Rebinding Attack", "tags": ["third-party-advisory"]}, {"url": "https://github.com/August829/CVEP/issues/32", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing a manipulation of the argument Host can lead to reliance on reverse dns resolution. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-350", "description": "Reliance on Reverse DNS Resolution"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-22T23:30:14.104Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6874", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T14:32:30.081126Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-23T14:32:34.904Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-6874", "state": "PUBLISHED", "dateUpdated": "2026-04-22T23:30:14.104Z", "dateReserved": "2026-04-22T18:20:59.444Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-22T23:30:14.104Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Header Handler"], "product": "copilot-api", "vendor": "ericc-ch", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2"}, {"status": "affected", "version": "0.3"}, {"status": "affected", "version": "0.4"}, {"status": "affected", "version": "0.5"}, {"status": "affected", "version": "0.6"}, {"status": "affected", "version": "0.7.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing a manipulation of the argument Host can lead to reliance on reverse dns resolution. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad se determin\u00f3 en ericc-ch copilot-api hasta 0.7.0. Esto afecta una funci\u00f3n desconocida del archivo /token del componente Gestor de Encabezados. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento Host puede llevar a la dependencia de la resoluci\u00f3n DNS inversa. El ataque puede realizarse de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede utilizarse. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-6874", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6874", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T14:32:30.081126Z", "version": "2.0.3"}}]}, "published": "2026-04-23T00:16:47.050", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/August829/CVEP/issues/32"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/795212"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359039"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359039/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-350"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "copilot-api", "source": "cna", "vendor": "ericc-ch"}, "product": "copilot-api", "vendor": "ericc-ch"}], "analysis": {"en": {"generated_at": "2026-04-28T20:40:37.086054+00:00", "value": {"mitigation_remediation": ["Update ericc\u2011ch copilot\u2011api to the latest release that addresses the Host header validation flaw; if no new release is available, apply the developer\u2011provided patch or modify the source code to enforce stricter validation.", "Configure the API service to accept only Host headers that match a predefined whitelist of allowed domains or IP addresses, effectively blocking arbitrary DNS rebinding attempts.", "Enable logging of incoming Host header values and monitor for unexpected or suspicious entries, alerting administrators to potential misuse."], "summary": {"action": "Apply Patch", "impact": "Improper header handling enabling DNS rebinding, inferred potential for authorization bypass"}, "threat_synthesis": {"affected_systems": "Affected systems include any installations of ericc\u2011ch copilot\u2011api running version 0.7.0 or earlier. The specific location is the Header Handler's handling of the /token route where Host header validation is performed. No other vendors or products are listed as impacted.", "description_and_impact": "The vulnerability resides in ericc\u2011ch's copilot\u2011api, affecting the Header Handler component up to version 0.7.0. A flaw in the /token endpoint allows manipulation of the Host HTTP header, causing the service to perform reverse DNS resolution on the supplied host. Because the API does not validate or restrict this header, an attacker can supply a crafted host value that maps back to the target system, potentially bypassing authentication checks or executing unintended paths (inferred). This weakness is classified as CWE\u2011350, indicating insufficient authentication or authorization controls.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.3, placing it in the moderate severity range. The EPSS score is less than 1\u202f%, suggesting that, at present, the likelihood of exploitation is low, and the vulnerability is not listed in CISA\u2019s KEV catalog. However, the attack can be conducted remotely simply by sending a crafted HTTP request to the service, which publicly disclosed the issue. While the immediate risk is moderate, the lack of official vendor remediation means that organizations should treat this as a potential vector for unauthorized access (inferred) until a patch is released."}}}}, "created": "2026-04-28T00:15:05.301455+00:00", "updated": "2026-04-28T20:45:16.603533+00:00", "vendors": ["ericc-ch", "ericc-ch$PRODUCT$copilot-api"]}