PT-2026-5013 · Cloudflare+1 · Cloudflare Workers+1

Kilkat · CVE-2026-24473 · Published 2026-01-27 · Updated 2026-02-04

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.7

Description The Serve static Middleware for the Cloudflare Workers adapter in Hono does not properly validate user-controlled paths, potentially allowing attackers to read arbitrary keys from the Workers environment. This improper validation can result in unintended access to internal asset keys. The issue affects applications running on Cloudflare Workers that utilize Serve static Middleware with user-controllable request paths and may lead to information disclosure. The exposed data is limited to readable asset keys and does not allow modification of stored data or execution of arbitrary code.

Recommendations Update to Hono version 4.11.7 or later.

Exploit

Fix

Improper Access Control

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-284

CWE-200

CWE-668

Related Identifiers

CVE-2026-24473

GHSA-W332-Q679-J88P

Affected Products

Cloudflare Workers

Hono

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24473.json · Exploit
• https://github.com/honojs/hono/commit/cf9a78db4d0a19b117aee399cbe9d3a6d9bfd817 · Patch
• https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24473 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w332-q679-j88p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24473 · Security Note
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/releases/tag/v4.11.7 · Note
• https://t.me/cveNotify/150865 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016389366411612337 · Twitter Post
• https://twitter.com/_cvereports/status/2016265117487292429 · Twitter Post