Read the docs
TI-2026-41380 Aliases CVE-2026-57443GHSA-q986-4x7x-gx39

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Priority HIGH 72CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0074 54th percentileScored 2026-11-07
Fix Fixed SCBE-AETHERMOORE (issdandavis): 4.2.1scbe-aethermoore (PyPI): 4.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
issdandavisSCBE-AETHERMOORE4.0.2 to before 4.2.14.2.1Patch availableCNA
—scbe-aethermoore (PyPI)4.0.2 to before 4.2.14.2.1Patch availableGHSA-q986-4x7x-gx39
  • SCBE-AETHERMOORE Vendorissdandavis Affected 4.0.2 to before 4.2.1 Fixed in 4.2.1 Patch available CNA
  • scbe-aethermoore (PyPI) Vendor— Affected 4.0.2 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-q986-4x7x-gx39

Remediation

  • Fix · CNA SCBE-AETHERMOORE (issdandavis) Fixed in 4.2.1
  • Fix · GHSA-q986-4x7x-gx39 scbe-aethermoore (PyPI) Fixed in 4.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57443
  2. 2026-10-03 Alias added: GHSA-q986-4x7x-gx39
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences