Is CVE-2026-57951 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57951 being exploited in the wild.

How severe is CVE-2026-57951?

Medium severity, with a CVSS score of 6.5, published 29 June 2026.

Which products and versions are affected?

Its-A-Feature Mythic before 3.4.0.60.

Is there a fix for CVE-2026-57951?

A patch was published on 2026-06-21: Version 3.4.0.60 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57951 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57951?

Check whether you run Its-A-Feature Mythic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57951: its-a-feature Mythic incorrect authorization in payload_build_step table

CVE-2026-57951 · Severity: medium · CVSS 6.5 · Published 2026-06-29

Mythic, a command-and-control framework used for security operations, contains a flaw that allows users to view sensitive data from projects they are not authorized to see. An authenticated user, even with limited view-only permissions, can access build logs and configuration details for every operation on the server. This could lead to the exposure of encryption keys, server addresses, and other internal operational details belonging to different teams or clients.

Technologies: Its-A-Feature Mythic. Vendors: Its-A-Feature.

Quick answers

Is CVE-2026-57951 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57951 being exploited in the wild.
How severe is CVE-2026-57951?: Medium severity, with a CVSS score of 6.5, published 29 June 2026.
Which products and versions are affected?: Its-A-Feature Mythic before 3.4.0.60.
Is there a fix for CVE-2026-57951?: A patch was published on 2026-06-21: Version 3.4.0.60 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57951 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57951?: Check whether you run Its-A-Feature Mythic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error exists in the Hasura row-level permission metadata for the 'payload_build_step' table. The filter uses an '_or' condition where the first branch checks if 'payloadtype_id' is not null; since this is a non-null foreign key, the condition is always satisfied. This causes Hasura to short-circuit and ignore the second branch intended to restrict access to the user's specific operation ID. Consequently, any authenticated user (operator or spectator) can query the GraphQL API to retrieve 'step_stdout', 'step_stderr', and other columns for all operations on the server. The issue is fixed in version 3.4.0.60.

Affected products

its-a-feature Mythic before 3.4.0.60

Timeline

2026-06-20: disclosed: Issue reported on GitHub by researcher George Chen
2026-06-21: patched: Version 3.4.0.60 released with fix
2026-06-29: advisory: NVD and VulnCheck advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.