PT-2026-40424 · Dalfox · Dalfox

Drmingler · Published 2026-05-12 · Updated 2026-05-27 · CVE-2026-45087

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dalfox versions prior to 2.12.0

Description When running in REST API server mode (dalfox server), the software binds to 0.0.0.0:6664 by default without requiring authentication. An unauthenticated attacker can send a request to the '/scan' endpoint providing arbitrary values for the found-action and found-action-shell variables. These values are deserialized and passed to the foundAction() function, which executes them via exec.Command whenever a scan finding is triggered. By hosting a reflective server to guarantee a finding, an attacker can achieve full remote code execution on the host system.

Recommendations For versions prior to 2.12.0, ensure the server is started with the --api-key flag to enable mandatory authentication. As a temporary mitigation, restrict network access to the server port (default 6664) to trusted sources only. Avoid using the found-action and found-action-shell variables in API requests.

Exploit

Fix

RCE

Missing Authentication

OS Command Injection

Weakness Enumeration

CWE-15

CWE-306

CWE-78

Related Identifiers

CVE-2026-45087

GHSA-V25V-M36W-JP4H

Affected Products

Dalfox

References · 8

• 🔥 https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45087 · Security Note
• https://osv.dev/vulnerability/GHSA-v25v-m36w-jp4h · Vendor Advisory
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0 · Note
• https://github.com/hahwul/dalfox · Note
• https://twitter.com/UpwindMDR/status/2054257235266580703 · Twitter Post
• https://t.me/poxek/6119 · Telegram Post
• https://twitter.com/CVEnew/status/2059718116444397874 · Twitter Post