Is CVE-2026-57953 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57953 being exploited in the wild.

How severe is CVE-2026-57953?

Medium severity, with a CVSS score of 5.4, published 29 June 2026.

Which products and versions are affected?

Its-A-Feature Mythic < 3.4.0.60.

Is there a fix for CVE-2026-57953?

A patch was published on 2026-06-21: Version 3.4.0.60 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57953 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57953?

Check whether you run Its-A-Feature Mythic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57953: its-a-feature Mythic auth bypass in eventing_import_automatic_webhook

Q: Is there a fix for CVE-2026-57953?

A patch was published on 2026-06-21: Version 3.4.0.60 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57953 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-57953?

Check whether you run Its-A-Feature Mythic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57953 · Severity: medium · CVSS 5.4 · Published 2026-06-29

Mythic, an open-source command and control (C2) framework used for security operations, contains a flaw where users with restricted 'spectator' access can perform unauthorized actions. While spectators are intended to have read-only access, this vulnerability allows them to create or delete automation workflows within their assigned operation. This could allow a restricted user to disrupt active security operations or modify how the system automatically responds to events.

Technologies: Its-A-Feature Mythic. Vendors: Its-A-Feature.

Quick answers

Is CVE-2026-57953 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57953 being exploited in the wild.
How severe is CVE-2026-57953?: Medium severity, with a CVSS score of 5.4, published 29 June 2026.
Which products and versions are affected?: Its-A-Feature Mythic < 3.4.0.60.
Is there a fix for CVE-2026-57953?: A patch was published on 2026-06-21: Version 3.4.0.60 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57953 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57953?: Check whether you run Its-A-Feature Mythic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization (CWE-863) vulnerability exists in Mythic's web server routing. The 'eventing_import_automatic_webhook' endpoint was incorrectly registered under 'RBACMiddlewareAll', which includes the 'spectator' role, instead of 'RBACMiddlewareNoSpectators'. An authenticated attacker with spectator privileges can send POST requests to this endpoint to write files to disk, insert database records, and soft-delete existing EventGroups. This allows for the unauthorized modification of automation workflows and EventGroups within the scope of the attacker's current operation. The issue is resolved in version 3.4.0.60.

Affected products

its-a-feature Mythic < 3.4.0.60

Timeline

2026-06-20: disclosed: Issue reported via GitHub
2026-06-21: patched: Version 3.4.0.60 released
2026-06-29: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.