CVE-2026-45577 MEDIUM

CVE-2026-45577: Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

Vendor Markmhendrickson
Product neotoma
Weakness CWE-288
Published May 29, 2026
Last update May 29, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolve unauthenticated requests as the local development user, making the hosted Inspector and related API surface reachable without credentials. This vulnerability is fixed in 0.11.1.

Key dates

02Disclosure timeline

May 29, 2026 CVE published
May 29, 2026 Record updated