CVE-2026-110616
Description
A flaw was found in NullHub. The management Application Programming Interface (API) fails to enforce authentication because the authentication token is left unassigned by default. A remote, unauthenticated attacker can exploit this vulnerability by sending direct requests to exposed service endpoints, gaining unauthorized administrative access. This allows attackers to manipulate agent instances, alter sensitive system configurations including stored credentials, and control background tasks.
Statement
Critical severity is assigned to this flaw because an unauthenticated remote attacker can gain full administrative control over the service without requiring user interaction or prior privileges. Without authentication enforced on management endpoints, an attacker can manipulate agent instances, access sensitive credentials, and alter scheduled tasks across the network. NullHub is not packaged or shipped in Red Hat Enterprise Linux or other Red Hat offerings, so supported platforms are not directly exposed under default configurations.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
