PT-2026-42207 · Algernon · Algernon

Dredsen · Published 2026-05-20 · Updated 2026-05-26 · CVE-2026-46430

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Algernon versions prior to 1.17.7

Description On Linux and macOS, the SSE event server binds to 0.0.0.0:5553 by default, making it accessible to any peer on the same local area network (LAN). This occurs because the platform-dependent host default in engine/flags.go sets the host variable to an empty string for non-Windows systems, which the utils.JoinHostPort() function resolves to listen on all available network interfaces. In contrast, Windows users are restricted to the loopback address. This allows an unauthorized network peer to connect to the server and read the file-change stream, leading to the disclosure of filenames and edit timing.

Recommendations Update to version 1.17.7.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-1188

Related Identifiers

CVE-2026-46430

GHSA-GJ84-924C-48FX

Affected Products

Algernon

References · 5

• 🔥 https://github.com/xyproto/algernon/security/advisories/GHSA-gj84-924c-48fx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46430 · Security Note
• https://osv.dev/vulnerability/GHSA-gj84-924c-48fx · Vendor Advisory
• https://github.com/xyproto/algernon · Note
• https://reddit.com/r/VulnMatter/comments/1tjljj9/resumen_diario_de_vulnerabilidades_21052026 · Reddit Post