Is CVE-2026-59148 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59148 being exploited in the wild.

How severe is CVE-2026-59148?

High severity, with a CVSS score of 8.8, published 9 July 2026.

Which products and versions are affected?

Mockoon Commons-Server < 9.7.0; Mockoon CLI < 9.7.0; @mockoon/cli (npm) SEMVER:introduced=0,fixed=9.7.0; @mockoon/commons-server (npm) SEMVER:introduced=0,fixed=9.7.0.

Is there a fix for CVE-2026-59148?

Yes. @mockoon/cli (npm): upgrade to 9.7.0 or later; @mockoon/commons-server (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59148 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-59148?

Check whether you run Mockoon Commons-Server, Mockoon CLI, @mockoon/cli (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59148: Mockoon Missing Authentication and Permissive CORS in Admin API

Q: Is there a fix for CVE-2026-59148?

Yes. @mockoon/cli (npm): upgrade to 9.7.0 or later; @mockoon/commons-server (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59148 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-59148?

Check whether you run Mockoon Commons-Server, Mockoon CLI, @mockoon/cli (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59148 · Severity: high · CVSS 8.8 · Published 2026-07-09

Mockoon's admin API, enabled by default on all network interfaces, lacks any authentication and permits wildcard cross-origin requests. An attacker with network access can read operator secrets, modify mock responses, poison environment variables, harvest transaction logs, and rewrite routes in real time. When deployed in shared environments like CI systems or accessed by developers visiting untrusted websites, this enables complete compromise of the mock server's state and downstream test/integration consumers.

Technologies: Mockoon Commons-Server. Vendors: Mockoon, npm.

Quick answers

Is CVE-2026-59148 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59148 being exploited in the wild.
How severe is CVE-2026-59148?: High severity, with a CVSS score of 8.8, published 9 July 2026.
Which products and versions are affected?: Mockoon Commons-Server < 9.7.0; Mockoon CLI < 9.7.0; @mockoon/cli (npm) SEMVER:introduced=0,fixed=9.7.0; @mockoon/commons-server (npm) SEMVER:introduced=0,fixed=9.7.0.
Is there a fix for CVE-2026-59148?: Yes. @mockoon/cli (npm): upgrade to 9.7.0 or later; @mockoon/commons-server (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59148 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-59148?: Check whether you run Mockoon Commons-Server, Mockoon CLI, @mockoon/cli (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@mockoon/cli (npm): upgrade to 9.7.0 or later
```
npm install @mockoon/cli@9.7.0
```
@mockoon/commons-server (npm): upgrade to 9.7.0 or later
```
npm install @mockoon/commons-server@9.7.0
```

Technical details

The vulnerability combines three critical weaknesses in Mockoon's admin API (commons-server/src/libs/server/admin-api.ts): (1) zero authentication—no bearer token, shared secret, or MOCKOON_ADMIN_TOKEN env var check; (2) permissive CORS headers (Access-Control-Allow-Origin: *, all HTTP methods, Content-Type in Allow-Headers) on every admin endpoint; and (3) no prefix validation on environment variable writes, allowing arbitrary process.env mutation. An unauthenticated network caller can: read MOCKOON_* secrets via GET /mockoon-admin/env-vars, write/poison any process.env key including AWS_SECRET_ACCESS_KEY and JWT secrets, rewrite mock route responses/status/headers at runtime via PUT /mockoon-admin/environment, harvest consumer auth headers and request bodies from transaction logs and SSE streams, and purge state. The server defaults to binding 0.0.0.0 (all interfaces) on port 3000. The wildcard CORS also enables cross-origin attacks from browser JavaScript, allowing a developer running mockoon-cli locally to be compromised by visiting a malicious website. Patch available in version 9.7.0; workarounds include disabling admin API with --disable-admin-api flag or binding to loopback.

Affected products

Mockoon @mockoon/commons-server < 9.7.0
Mockoon @mockoon/cli < 9.7.0
Mockoon @mockoon/serverless < 9.7.0

Identifiers

CVE-2026-59148
GHSA-rqx4-3f6q-3x2v

Timeline

2026-06-22: disclosed: Initial GitHub advisory published
2026-09-11: patched: Version 9.7.0 released with fixes
2026-09-11: advisory: GHSA-rqx4-3f6q-3x2v and CVE-2026-59148 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.