Is CVE-2026-16551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16551 being exploited in the wild.

How severe is CVE-2026-16551?

Informational severity, with a CVSS score of 6.9, published 22 July 2026.

Which products and versions are affected?

Thinkst Applied Research OpenCanary 0.9.8.

Is there a fix for CVE-2026-16551?

A patch was published on 2026-07-22: Fixed in version 0.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16551 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-16551?

Check whether you run Thinkst Applied Research OpenCanary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16551: Thinkst Applied Research OpenCanary DoS in MongoDB module

CVE-2026-16551 · Severity: info · CVSS 6.9 · Published 2026-07-22

OpenCanary is a honeypot tool used to detect unauthorized activity on a network by mimicking real services. A vulnerability in its MongoDB module allows a remote attacker to crash or freeze the service using a single specially crafted network packet. This results in a denial-of-service, preventing the honeypot from performing its security monitoring functions.

Vendors: Thinkst Applied Research.

Quick answers

Is CVE-2026-16551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16551 being exploited in the wild.
How severe is CVE-2026-16551?: Informational severity, with a CVSS score of 6.9, published 22 July 2026.
Which products and versions are affected?: Thinkst Applied Research OpenCanary 0.9.8.
Is there a fix for CVE-2026-16551?: A patch was published on 2026-07-22: Fixed in version 0.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16551 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-16551?: Check whether you run Thinkst Applied Research OpenCanary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in the MongoDB module of OpenCanary version 0.9.8. The flaw is rooted in improper input validation (CWE-20) and an infinite loop condition (CWE-835) triggered by a single malicious packet. When exploited, the Twisted process consumes 100% of the available CPU core, leading to excessive resource allocation and service unavailability. The vulnerability is reachable over the network without authentication. The issue is resolved in version 0.9.9; users unable to upgrade can mitigate the risk by disabling the MongoDB module in the configuration file.

Affected products

Thinkst Applied Research OpenCanary 0.9.8

Timeline

2026-07-22: disclosed
2026-07-22: advisory
2026-07-22: patched: Fixed in version 0.9.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.