CVE-2026-63406

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory's claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15.

• CWE-312
• CWE-798

• https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee
• https://github.com/anycable/anycable/releases/tag/v1.6.15
• https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm
• https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6339Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail …4.3
• CVE-2026-63397remorses/genql before version 6.3.4 allows an authenticated …7.1
• CVE-2026-6340Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…6.5
• CVE-2026-63403Faktory is a language-agnostic background job server. In ver…8.7
• CVE-2026-63404Faktory is a language-agnostic background job server. In ver…7.3
• CVE-2026-63405AnyCable is a realtime server for reliable two-way communica…5.9
• CVE-2026-63407Grav API Plugin is a RESTful API for Grav CMS that provides …8.2
• CVE-2026-63408Grav API Plugin is a RESTful API for Grav CMS that provides …7.5
• CVE-2026-63409Deskflow is a keyboard and mouse sharing app. From 1.17.0 un…8.2
• CVE-2026-6341Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 …4.3
• CVE-2026-63416draw.io is a configurable diagramming and whiteboarding appl…3.7
• CVE-2026-63419OpenImageIO is a toolset for reading, writing, and manipulat…7.8