PT-2026-51764 · Thinkst Applied Research · Canarytokens

Arkadiusz Marta · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-13140

Mitre

CVSS v4.0

2.0

Low

Base vector

AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens.

Anonymous exploitation requires knowledge of a random identifier.

This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-13140

Affected Products

Canarytokens

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-13140 · Security Note
• https://github.com/thinkst/canarytokens/security/advisories/GHSA-23pf-xjp2-48q6 · Note