Quick answers
- Is CVE-2026-105858 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105858 being exploited in the wild.
- How severe is CVE-2026-105858?
- High severity, with a CVSS score of 8.1, published 6 October 2026.
- Which products and versions are affected?
- payload (npm) SEMVER:introduced=0,fixed=3.90.0; Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34.
- Is there a fix for CVE-2026-105858?
- Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-105858 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-105858?
- Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- payload (npm): upgrade to 3.90.0 or later
npm install payload@3.90.0
Technical details
A remote code execution vulnerability exists in the first-register operation when local authentication is enabled and no initial user has been provisioned. An unauthenticated attacker can craft a malicious request to the public registration endpoint to execute arbitrary code. The vulnerability has been fixed by restricting access to public admin verification routes.
Affected products
- Payload Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34
Identifiers
- CVE-2026-105858
- GHSA-97rh-rhh2-7vjv
Timeline
- 2026-10-06: disclosed