Vulnerabilities

TI-2026-70548 CVE-2026-108549 · GHSA-h8j8-r6g6-37hc

Missing authentication in cc-connect MAX webhook lets attackers run commands

MEDIUM 42

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00451 Published 2026-10-10 No fix listed CWE-306

TI-2026-62540 CVE-2026-92801 · GHSA-2qg4-97v5-72x5

cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

MEDIUM 40

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00549 Published 2026-09-16 No fix listed CWE-863

TI-2026-53639 CVE-2026-76761 · GHSA-v2jj-5g64-rxp4

chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

HIGH 70

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.02109 Published 2026-08-19 No fix listed CWE-77

TI-2026-53638 CVE-2026-76760 · GHSA-wfx9-6h8h-f3gm

chenhg5 cc-connect webhook.go authenticate code injection

HIGH 70

A vulnerability was found in chenhg5 cc-connect up to 1.4.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00541 Published 2026-08-19 No fix listed CWE-74

Vulnerabilities

Filters

Missing authentication in cc-connect MAX webhook lets attackers run commands

cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

chenhg5 cc-connect webhook.go authenticate code injection