# CVE-2026-57952: its-a-feature Mythic authorization bypass in C2 profile endpoints

Source: https://junglewise.ai/threats/cve-2026-57952-its-a-feature-mythic-authorization-bypass-in-c2-profile-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-57952 · Severity: medium · CVSS 5.3 · Published 2026-06-29

Mythic, an open-source command-and-control (C2) framework used by security teams, contains a security flaw that allows users in one operation to view sensitive data from another operation. By using a known identifier from a different project, an authorized user can bypass isolation boundaries to access encryption keys, callback parameters, and infrastructure details. This could lead to the exposure of sensitive engagement data and compromise the operational security of separate teams or clients sharing the same server.

Technologies: [Its-A-Feature Mythic](https://junglewise.ai/threats/technologies/mythic). Vendors: [Its-A-Feature](https://junglewise.ai/threats/vendors/its-a-feature).

## Quick answers

**Is CVE-2026-57952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57952 being exploited in the wild.

**How severe is CVE-2026-57952?** Medium severity, with a CVSS score of 5.3, published 29 June 2026.

**Which products and versions are affected?** Its-A-Feature Mythic < 3.4.0.60.

**Is there a fix for CVE-2026-57952?** A patch was published on 2026-06-21: Version 3.4.0.60 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57952 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57952?** Check whether you run Its-A-Feature Mythic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass vulnerability exists in Mythic's webserver controllers due to missing operation-scope validation during payload lookups. Specifically, the endpoints c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, and c2profile_sample_message_webhook query the database for a payload by UUID without verifying that the payload's operation_id matches the caller's current operation. An authenticated attacker (operator or spectator) can provide a UUID from a different operation to trigger RabbitMQ RPC calls that return sensitive C2 profile data, including encryption keys (enc_key/dec_key), redirector rules, and IOCs. This vulnerability is addressed in version 3.4.0.60 by adding the necessary operation_id check to the SQL queries.

## Affected products

- its-a-feature Mythic < 3.4.0.60

## Timeline

- 2026-06-20: disclosed: Issue reported via GitHub issue #564
- 2026-06-21: patched: Version 3.4.0.60 released with fix
- 2026-06-29: advisory: CVE-2026-57952 published

## References

- [https://github.com/its-a-feature/Mythic/commit/82648e8241b800a32e1882afc310e7316d98ebaa](https://github.com/its-a-feature/Mythic/commit/82648e8241b800a32e1882afc310e7316d98ebaa)
- [https://github.com/its-a-feature/Mythic/issues/564](https://github.com/its-a-feature/Mythic/issues/564)
- [https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60](https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60)
- [https://www.vulncheck.com/advisories/mythic-unauthorized-c2-profile-configuration-access-via-unverified-payload-uuid](https://www.vulncheck.com/advisories/mythic-unauthorized-c2-profile-configuration-access-via-unverified-payload-uuid)

## Related threats

- [its-a-feature Mythic auth bypass in eventing_import_automatic_webhook](https://junglewise.ai/threats/cve-2026-57953-its-a-feature-mythic-auth-bypass-in-eventing-import-automatic)
- [its-a-feature Mythic incorrect authorization in payload_build_step table](https://junglewise.ai/threats/cve-2026-57951-its-a-feature-mythic-incorrect-authorization-in-payload-build)