{"cve":"CVE-2026-45577","nvd":{"published":"2026-05-29T18:17:10.007","modified":"2026-07-21T15:10:00.103","status":"Deferred","description":"Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolve unauthenticated requests as the local development user, making the hosted Inspector and related API surface reachable without credentials. This vulnerability is fixed in 0.11.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":null,"cwes":["CWE-288","CWE-306"],"references":["https://github.com/markmhendrickson/neotoma/releases/tag/v0.11.1","https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-5cvp-p7p4-mcx9"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:37:48.043517290+00:00"},"epss":{"cve":"CVE-2026-45577","score":0.00249,"percentile":0.16267,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5cvp-p7p4-mcx9","url":"https://osv.dev/vulnerability/GHSA-5cvp-p7p4-mcx9","summary":"Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass","modified":"2026-06-09T10:45:13.948548997Z","packages":[{"ecosystem":"npm","name":"neotoma","purl":"pkg:npm/neotoma","ranges":[">=0.6.0 <0.11.1"],"fixed":["0.11.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}