Missing authorization in Rill OAuth server issues tokens
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Rill 0.77.0 through 0.90.5 contains missing authorization (CWE-862) in its admin OAuth server, which issues authorization codes to dynamically registered clients without user consent. An unauthenticated remote attacker can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Rill.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108718
- 2026-10-11 Alias added: GHSA-r44j-vvw7-323g
- 2026-10-12 Priority changed: MEDIUM → LOW
- 2026-10-18 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 4
- https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/handlers.go#L650-L697
- https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/mcp_oauth.go#L77-L153
- https://github.com/rilldata/rill/blob/b9ea8c6f215e56c4c0848771e70b3ec38346eacc/admin/server/auth/pkce.go#L173-L214
- https://github.com/rilldata/rill
Sources
- CVE-2026-108718 · CVE Program
- CVE-2026-108718 · NVD
- FIRST EPSS
- GHSA-r44j-vvw7-323g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-108718 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences