CVE-2024-12973 MEDIUM

CVE-2024-12973: Host Header Injection in Akinsoft's OctoCloud

Vendor Akinsoft

Product OctoCloud

Weakness CWE-346 · Origin validation

Published September 2, 2025

Last update June 1, 2026

View on NVD All CVEs

CVSS base score

4.7/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from s1.09.01 before v1.11.01.

Key dates

02Disclosure timeline

September 2, 2025 CVE published

June 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-12973 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/346.html

Related vulnerabilities

04Related CVE

CVE-2026-37977 Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim CVE-2025-46737 Origin Validation Error CVE-2021-39185 Default CORS config allows any origin with credentials CVE-2025-14279 DNS Rebinding Vulnerability in mlflow/mlflow CVE-2026-45021 Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin