CVE-2026-63406

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63406
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63406.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63406
Aliases
Published
2026-09-18T16:51:54Z
Modified
2026-09-19T03:47:27Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
Details

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and raw os.Args returned by anycableCLIArgs, including values supplied through --secret, --jwt_secret, and --http_rpc_secret. These inputs are passed to generateDigest, where sha256.New produces the hexadecimal fingerprint that is sent as telemetry. The available source therefore does not show raw credentials leaving the process or establish the advisory's claimed confidentiality loss, although the stable fingerprint is derived from secret-bearing configuration and the default telemetry client uses publicly known authentication material. This issue is fixed in version 1.6.15.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-312",
        "CWE-798"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63406.json"
}
References

Affected packages

Git / github.com/anycable/anycable

Affected ranges

Type
GIT
Repo
https://github.com/anycable/anycable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6e7591c009e53186b64ab013d10ab26aac9e7899
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.15"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.2.0
0.5.0
0.5.0.1
0.5.1
v0.*
v0.5.3
v0.5.4
v0.6.0-preview1
v0.6.0-preview2
v0.6.0-preview3
v0.6.0-preview4
v0.6.0-preview5
v1.*
v1.0.4
v1.0.5
v1.4.0-rc.1
v1.4.0-rc.2
v1.4.0-rc.3
v1.4.0.rc1
v1.4.4.1
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.5.0-rc.1
v1.5.2.1
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.6.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.0-rc.3
v1.6.0-rc.4
v1.6.0-rc.5
v1.6.1
v1.6.10
v1.6.11
v1.6.12
v1.6.13
v1.6.14
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.6.9-pre.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63406.json"