CVE-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

• CWE-22
• CWE-94
• CWE-306

• https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
• https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
• https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5
• https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb
• https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
• https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
• https://github.com/storybookjs/storybook/pull/36726
• https://github.com/storybookjs/storybook/releases/tag/v10.6.2
• https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
• https://github.com/storybookjs/storybook/releases/tag/v8.6.19
• https://github.com/storybookjs/storybook/releases/tag/v9.1.21
• https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114120SchedulePress before 5.3.5 contains a missing authorization …5.4
• CVE-2026-114121Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-114122Electron is a framework for writing cross-platform desktop a…3.9
• CVE-2026-114123D365 F&O MCP Server is a Model Context Protocol server for q…7.5
• CVE-2026-114124Electron is a framework for writing cross-platform desktop a…3.9
• CVE-2026-114125Storybook is a frontend workshop for building user interface…8.6
• CVE-2026-114127Astro is a web framework for content-driven websites. From 7…2.3
• CVE-2026-114128Astro is a web framework for content-driven websites. Prior …6.5
• CVE-2026-114129stream-json is a micro-library of stream components for proc…6.2
• CVE-2026-11413A security vulnerability has been detected in JingDong JD Cl…8.8
• CVE-2026-114130Nuxt is an open-source web development framework for Vue.js.…2.3
• CVE-2026-114131Nuxt is an open-source web development framework for Vue.js.…6.5