Search
Find a vulnerability
Search criteria
1 vulnerability by elizaOS
CVE-2026-124587 (GCVE-0-2026-124587)
Vulnerability from cvelistv5 – Published: 2026-11-09 09:30 – Updated: 2026-11-09 22:36 X_Open Source
VLAI
EPSS
VEX
Title
elizaOS eliza HTTP Server api-base-owner.ts information disclosure
Summary
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:35 UTC
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433011 | vdb-entry |
| https://vuldb.com/vuln/433011/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124587 | third-party-advisory |
| https://vuldb.com/submit/1039543 | third-party-advisory |
| https://github.com/elizaOS/eliza/issues/33034 | exploitissue-tracking |
| https://github.com/elizaOS/eliza/pull/33142 | issue-trackingpatch |
| https://github.com/elizaOS/eliza/commit/cf6fa1930… | patch |
| https://github.com/elizaOS/eliza/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124587",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:35:57.772173Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:36:09.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:elizaos:eliza:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Server"
],
"product": "eliza",
"vendor": "elizaOS",
"versions": [
{
"status": "affected",
"version": "2.0.3-beta.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "akamoli (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T09:30:27.977Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433011 | elizaOS eliza HTTP Server api-base-owner.ts information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/433011"
},
{
"name": "VDB-433011 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433011/cti"
},
{
"name": "CVE-2026-124587 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124587"
},
{
"name": "Submit #1039543 | github.com/elizaOS eliza 2.0.3-beta.7 Local Sensitive Logic exposure lead to token leak",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1039543"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/elizaOS/eliza/issues/33034"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/elizaOS/eliza/pull/33142"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2"
},
{
"tags": [
"product"
],
"url": "https://github.com/elizaOS/eliza/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T21:38:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "elizaOS eliza HTTP Server api-base-owner.ts information disclosure",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124587",
"datePublished": "2026-11-09T09:30:27.977Z",
"dateReserved": "2026-11-08T20:33:37.496Z",
"dateUpdated": "2026-11-09T22:36:09.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}