CVE-2026-44479

Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-interactive or auto-detected AI agent), commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included verbatim in those suggestions. The plaintext token may be captured in CI/CD logs, agent transcripts, or other automation output. This vulnerability is fixed in 52.0.1.

• CWE-200
• CWE-532

• https://github.com/vercel/vercel/security/advisories/GHSA-pgf8-2hgj-grqgMitigation, Vendor Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44471gitoxide is an implementation of git written in Rust. Prior …7.8
• CVE-2026-44473Ella Core is a 5G core designed for private networks. Prior …7.1
• CVE-2026-44474Ella Core is a 5G core designed for private networks. Prior …3.7
• CVE-2026-44475Ella Core is a 5G core designed for private networks. Prior …6.1
• CVE-2026-44477CloudNativePG is a platform designed to manage PostgreSQL da…9.9
• CVE-2026-44478hoppscotch is an open source API development ecosystem. The …7.5
• CVE-2026-4448Heap buffer overflow in ANGLE in Google Chrome prior to 146.…8.8
• CVE-2026-44482soundcloud-rpc is a SoundCloud Client with Discord Rich Pres…9.6
• CVE-2026-44483RVF (formerly Remix Validated Form) provides easy form valid…8.2
• CVE-2026-44484PyTorch Lightning is a deep learning framework to pretrain a…9.8
• CVE-2026-44486Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44487Axios is a promise based HTTP client for the browser and Nod…7.5