CVE-2026-59148: Mockoon Missing Authentication and Permissive CORS in Admin API

Executive brief

Mockoon's admin API, enabled by default on all network interfaces, lacks any authentication and permits wildcard cross-origin requests. An attacker with network access can read operator secrets, modify mock responses, poison environment variables, harvest transaction logs, and rewrite routes in real time. When deployed in shared environments like CI systems or accessed by developers visiting untrusted websites, this enables complete compromise of the mock server's state and downstream test/integration consumers.

Technical details

The vulnerability combines three critical weaknesses in Mockoon's admin API (commons-server/src/libs/server/admin-api.ts): (1) zero authentication—no bearer token, shared secret, or MOCKOON_ADMIN_TOKEN env var check; (2) permissive CORS headers (Access-Control-Allow-Origin: *, all HTTP methods, Content-Type in Allow-Headers) on every admin endpoint; and (3) no prefix validation on environment variable writes, allowing arbitrary process.env mutation. An unauthenticated network caller can: read MOCKOON_* secrets via GET /mockoon-admin/env-vars, write/poison any process.env key including AWS_SECRET_ACCESS_KEY and JWT secrets, rewrite mock route responses/status/headers at runtime via PUT /mockoon-admin/environment, harvest consumer auth headers and request bodies from transaction logs and SSE streams, and purge state. The server defaults to binding 0.0.0.0 (all interfaces) on port 3000. The wildcard CORS also enables cross-origin attacks from browser JavaScript, allowing a developer running mockoon-cli locally to be compromised by visiting a malicious website. Patch available in version 9.7.0; workarounds include disabling admin API with --disable-admin-api flag or binding to loopback.

Affected products

• Mockoon @mockoon/commons-server < 9.7.0
• Mockoon @mockoon/cli < 9.7.0
• Mockoon @mockoon/serverless < 9.7.0

Timeline

• 2026-06-22: disclosed: Initial GitHub advisory published
• 2026-09-11: patched: Version 9.7.0 released with fixes
• 2026-09-11: advisory: GHSA-rqx4-3f6q-3x2v and CVE-2026-59148 published

References

• https://api.github.com/users/sajdakabir
• https://github.com/sajdakabir
• https://api.github.com/users/sajdakabir/gists%7B/gist_id%7D
• https://api.github.com/users/sajdakabir/repos
• https://avatars.githubusercontent.com/u/86569763?v=4
• https://api.github.com/users/sajdakabir/events%7B/privacy%7D