Read the docs
TI-2026-78906 Aliases CVE-2026-114126GHSA-px85-f4q5-jh77

Storybook dev server exposes WebSocket token to LAN attackers

Priority MEDIUM 46CWE-22Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-306 and CWE-94.

Summary

Storybook from 8.0.0 before 8.6.19, 9.0.0 before 9.1.21, 10.0.0 before 10.6.2 and 11.0.0-alpha.0 before 11.0.0-alpha.6 are affected. The development server can expose its WebSocket authentication token to clients that load its pages over a local network (CWE-306). A LAN attacker can use the token to write files, and weak validation lets code be placed in story files. With an old Vitest version and the Storybook Vitest addon, this can lead to code execution as the developer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Partial storybook (storybookjs): 8.6.19, 9.1.21, 10.6.2 +1storybook (npm): 8.6.19, 9.1.21, 10.6.2 +1+5 more productsRed Hat: 3 advisoriesRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
storybookjsstorybook8.0.0 to before 8.6.19; 9.0.0 to before 9.1.21; 10.0.0 to before 10.6.2; 11.0.0-alpha.0 to before 11.0.0-alpha.68.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6Patch availableCNA
—storybook (npm)8.0.0 to before 8.6.198.6.19Patch availableGHSA-px85-f4q5-jh77
—storybook (npm)9.0.0 to before 9.1.219.1.21Patch availableGHSA-px85-f4q5-jh77
—storybook (npm)10.0.0 to before 10.6.210.6.2Patch availableGHSA-px85-f4q5-jh77
—storybook (npm)11.0.0-alpha.0 to before 11.0.0-alpha.611.0.0-alpha.6Patch availableGHSA-px85-f4q5-jh77
—@storybook/core (npm)8.0.0 to before 8.6.198.6.19Patch availableGHSA-px85-f4q5-jh77
—@storybook/core-server (npm)8.0.0 to before 8.6.198.6.19Patch availableGHSA-px85-f4q5-jh77
—@storybook/experimental-addon-test (npm)8.0.0 to before 8.6.198.6.19Patch availableGHSA-px85-f4q5-jh77
—@storybook/addon-vitest (npm)9.0.0 to before 9.1.219.1.21Patch availableGHSA-px85-f4q5-jh77
—@storybook/addon-vitest (npm)10.0.0 to before 10.6.210.6.2Patch availableGHSA-px85-f4q5-jh77
—@storybook/addon-vitest (npm)11.0.0-alpha.0 to before 11.0.0-alpha.611.0.0-alpha.6Patch availableGHSA-px85-f4q5-jh77
—@storybook/addon-mcp (npm)10.6.0 to before 10.6.210.6.2Patch availableGHSA-px85-f4q5-jh77
—@storybook/addon-mcp (npm)11.0.0-alpha.0 to before 11.0.0-alpha.611.0.0-alpha.6Patch availableGHSA-px85-f4q5-jh77
  • storybook Vendorstorybookjs Affected 8.0.0 to before 8.6.19; 9.0.0 to before 9.1.21; 10.0.0 to before 10.6.2; 11.0.0-alpha.0 to before 11.0.0-alpha.6 Fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6 Patch available CNA
  • storybook (npm) Vendor— Affected 8.0.0 to before 8.6.19 Fixed in 8.6.19 Patch available GHSA-px85-f4q5-jh77
  • storybook (npm) Vendor— Affected 9.0.0 to before 9.1.21 Fixed in 9.1.21 Patch available GHSA-px85-f4q5-jh77
  • storybook (npm) Vendor— Affected 10.0.0 to before 10.6.2 Fixed in 10.6.2 Patch available GHSA-px85-f4q5-jh77
  • storybook (npm) Vendor— Affected 11.0.0-alpha.0 to before 11.0.0-alpha.6 Fixed in 11.0.0-alpha.6 Patch available GHSA-px85-f4q5-jh77
  • @storybook/core (npm) Vendor— Affected 8.0.0 to before 8.6.19 Fixed in 8.6.19 Patch available GHSA-px85-f4q5-jh77
  • @storybook/core-server (npm) Vendor— Affected 8.0.0 to before 8.6.19 Fixed in 8.6.19 Patch available GHSA-px85-f4q5-jh77
  • @storybook/experimental-addon-test (npm) Vendor— Affected 8.0.0 to before 8.6.19 Fixed in 8.6.19 Patch available GHSA-px85-f4q5-jh77
  • @storybook/addon-vitest (npm) Vendor— Affected 9.0.0 to before 9.1.21 Fixed in 9.1.21 Patch available GHSA-px85-f4q5-jh77
  • @storybook/addon-vitest (npm) Vendor— Affected 10.0.0 to before 10.6.2 Fixed in 10.6.2 Patch available GHSA-px85-f4q5-jh77
  • @storybook/addon-vitest (npm) Vendor— Affected 11.0.0-alpha.0 to before 11.0.0-alpha.6 Fixed in 11.0.0-alpha.6 Patch available GHSA-px85-f4q5-jh77
  • @storybook/addon-mcp (npm) Vendor— Affected 10.6.0 to before 10.6.2 Fixed in 10.6.2 Patch available GHSA-px85-f4q5-jh77
  • @storybook/addon-mcp (npm) Vendor— Affected 11.0.0-alpha.0 to before 11.0.0-alpha.6 Fixed in 11.0.0-alpha.6 Patch available GHSA-px85-f4q5-jh77

Remediation

Upgrade Storybook to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 for the matching release line, and @storybook/addon-mcp to 10.6.2 or 11.0.0-alpha.6. Red Hat fixes Red Hat Hardened Images in RHSA-2026:88541, RHSA-2026:88537 and RHSA-2026:88478. Red Hat lists Node HealthCheck Operator and Red Hat Build of Podman Desktop as affected with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA storybook (storybookjs) Fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6
  • Fix · GHSA-px85-f4q5-jh77 storybook (npm) Fixed in 8.6.19 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 storybook (npm) Fixed in 9.1.21 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 storybook (npm) Fixed in 10.6.2 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 storybook (npm) Fixed in 11.0.0-alpha.6 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/core (npm) Fixed in 8.6.19 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/core-server (npm) Fixed in 8.6.19 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/experimental-addon-test (npm) Fixed in 8.6.19 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/addon-vitest (npm) Fixed in 9.1.21 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/addon-vitest (npm) Fixed in 10.6.2 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/addon-vitest (npm) Fixed in 11.0.0-alpha.6 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/addon-mcp (npm) Fixed in 10.6.2 Advisory →
  • Fix · GHSA-px85-f4q5-jh77 @storybook/addon-mcp (npm) Fixed in 11.0.0-alpha.6 Advisory →

Red Hat 3 advisories

  • RHSA-2026:88541 Released 2026-10-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.4-0.3.hum1@aarch64, grafana13.2-13.2.4-0.3.hum1@s390x, grafana13.2-13.2.4-0.3.hum1@src +1
  • RHSA-2026:88537 Released 2026-10-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.8-0.4.hum1@aarch64, grafana13.1-13.1.8-0.4.hum1@s390x, grafana13.1-13.1.8-0.4.hum1@src +1
  • RHSA-2026:88478 Released 2026-10-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.13-0.3.hum1@aarch64, grafana12.4-12.4.13-0.3.hum1@src, grafana12.4-12.4.13-0.3.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node HealthCheck OperatorAffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:88478, RHSA-2026:88537, RHSA-2026:88541
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114126
  2. 2026-10-22 Affected versions changed · Red Hat
  3. 2026-10-22 CVSS score added · Red Hat
  4. 2026-10-22 Alias added: GHSA-px85-f4q5-jh77
  5. 2026-10-22 Fix available: npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected] +9 · GHSA-px85-f4q5-jh77
  6. 2026-10-22 CVSS score added · GHSA-px85-f4q5-jh77
  7. 2026-10-22 Weakness changed · GHSA-px85-f4q5-jh77
  8. 2026-10-22 14 new references · GHSA-px85-f4q5-jh77
  9. 2026-10-23 Fix available: RHSA-2026:88541 · Red Hat
  10. 2026-10-23 Fix available: RHSA-2026:88478 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88537 · Red Hat
  12. 2026-10-23 Fix available: Red Hat Hardened Images · Red Hat
  13. 2026-10-23 Priority changed: MEDIUM → LOW
  14. 2026-10-28 CISA SSVC decision points changed
  15. 2026-10-28 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 13

  • TI-2026-78905 Missing origin checks in Storybook preview allow code injection CVSS 4.0HIGH 8.6
  • TI-2026-34698 TeleJSON < 6.0.0 DOM-based XSS via parse() Function CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences