What happened
Verified via NVD REST API (published 2026-10-14, CVSS 8.1 v3.1 / 9.2 v4.0). The API was designed to require a token that is never assigned or enforced, leaving the entire management surface open to anyone with network reach when bound beyond loopback.
Why it matters
A self-hosted AI agent platform exposing its management API without authentication lets an outside attacker take over the agent fleet and swap in their own provider credentials/configuration — full compromise of the agent infrastructure and the secrets it holds. Deployers must place NullHub behind an authenticated reverse proxy and keep it loopback-bound.
Attack vector
No authentication: requests without Authorization/Origin headers to non-loopback listeners are accepted by the /api/* management API (auth_token field defaults to null). Attacker controls agent instances, rewrites config including provider credentials, and manages cron jobs and MCP servers (CWE-306).
Affected systems
NullHub through 2026.5.29
Mitigation
Update NullHub to a fixed release (or proxy the /api/* surface behind authentication); bind to loopback only; rotate any provider credentials that may have been exposed.