Permissive CORS in LoopX serve-status exposes control-plane state
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
LoopX from 0.0.1 before 0.4.5 sends a wildcard Access-Control-Allow-Origin header on unauthenticated responses from the loopx serve-status server. A remote attacker whose attacker-controlled web content an operator visits can read control-plane state, goal and run data, local absolute paths and private Markdown files through cross-origin requests to the predictable loopback port (CWE-942). The affected routes do not allow cross-origin writes or arbitrary file access.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| huangruiteng | loopx | 0.0.1 to before 0.4.5 | 0.4.5 | Patch available | CNA |
| — | loopx (PyPI) | 0.0.1 to before 0.4.5 | 0.4.5 | Patch available | GHSA-vx2m-gpq4-8j5q |
- loopx Vendorhuangruiteng Affected 0.0.1 to before 0.4.5 Fixed in 0.4.5 Patch available CNA
- loopx (PyPI) Vendor— Affected 0.0.1 to before 0.4.5 Fixed in 0.4.5 Patch available GHSA-vx2m-gpq4-8j5q
Remediation
Upgrade the PyPI package loopx to version 0.4.5, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA loopx (huangruiteng) Fixed in 0.4.5
- Fix · GHSA-vx2m-gpq4-8j5q loopx (PyPI) Fixed in 0.4.5 Advisory →
Timeline
- 2026-10-18 Threatist record created from CVE-2026-108372
- 2026-10-18 Priority changed: MEDIUM → LOW
- 2026-10-19 Alias added: GHSA-vx2m-gpq4-8j5q
- 2026-10-19 Fix available: PyPI/[email protected] · GHSA-vx2m-gpq4-8j5q
- 2026-10-19 CVSS score added · GHSA-vx2m-gpq4-8j5q
- 2026-10-19 Weakness changed · GHSA-vx2m-gpq4-8j5q
- 2026-10-19 7 new references · GHSA-vx2m-gpq4-8j5q
- 2026-10-21 CISA SSVC decision points changed
- 2026-10-21 Priority changed: LOW → HIGH
References
Other 6
- https://github.com/loopx-project/loopx/security/advisories/GHSA-vx2m-gpq4-8j5q
- https://github.com/loopx-project/loopx/pull/3137
- https://github.com/loopx-project/loopx/commit/838720fba42bd22f71b5bb763ec406f7bdf4c940
- https://github.com/loopx-project/loopx/releases/tag/v0.4.5
- https://github.com/huangruiteng/loopx/security/advisories/GHSA-vx2m-gpq4-8j5q
- https://github.com/huangruiteng/loopx
Sources
- CVE-2026-108372 · CVE Program
- CVE-2026-108372 · NVD
- FIRST EPSS
- GHSA-vx2m-gpq4-8j5q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences