PT-2026-41689 · Markmhendrickson+1 · Neotoma

Mark Hendrickson + 1 · Published 2026-05-18 · Updated 2026-05-31 · CVE-2026-45577

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Neotoma versions 0.6.0 through 0.11.0

Description Neotoma can treat public reverse-proxied requests as local when the application receives them over a loopback socket and no Bearer token is present. This occurs in deployments behind a reverse proxy or same-host tunnel that forwards traffic to the Node process over loopback. The REST auth middleware may resolve these unauthenticated requests as the local development user, allowing unauthorized access to production data via the hosted Inspector and related API surface without credentials.

Recommendations Update to version 0.11.1.

Fix

Authentication Bypass Using an Alternate Path or Channel

Missing Authentication

Weakness Enumeration

CWE-288

CWE-306

Related Identifiers

CVE-2026-45577

GHSA-5CVP-P7P4-MCX9

Affected Products

Neotoma

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-45577 · Security Note
• https://osv.dev/vulnerability/GHSA-5cvp-p7p4-mcx9 · Vendor Advisory
• https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-5cvp-p7p4-mcx9 · Note
• https://github.com/markmhendrickson/neotoma/releases/tag/v0.11.1 · Note
• https://github.com/markmhendrickson/neotoma · Note
• https://twitter.com/CVEnew/status/2061216687509176797 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1tgqoye/resumen_diario_de_vulnerabilidades_18052026 · Reddit Post
• https://t.me/CVEtracker/55272 · Telegram Post
• https://twitter.com/infoflowcloud/status/2061219083316588696 · Twitter Post