What happened
NVD published CVE-2026-53977 (CVSS 7.5, High) on August 6, 2026, describing a route-ordering bug that lets an unauthenticated attacker crash the OpenChamber server via its shutdown API.
Why it matters
While only a DoS, remote unauthenticated shutdown of an AI service disrupts availability for all dependent agent workflows with a single unauthenticated HTTP request.
Attack vector
The /api/system/shutdown endpoint is registered before the Express authentication middleware in the route chain, allowing an unauthenticated remote attacker to POST to it and terminate the server process (denial of service).
Affected systems
OpenChamber 1.11.7
Mitigation
Reorder middleware so authentication is enforced before all routes; upgrade to a patched OpenChamber release.