Is CVE-2026-63188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63188 being exploited in the wild.

How severe is CVE-2026-63188?

High severity, with a CVSS score of 4, published 19 August 2026.

Which products and versions are affected?

Logto Tunnel <= 0.3.8; @logto/tunnel (npm) <= 0.3.8, SEMVER:introduced=0,fixed=0.3.9.

Is there a fix for CVE-2026-63188?

Yes. @logto/tunnel (npm): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63188 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63188?

Check whether you run Logto Tunnel or @logto/tunnel (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63188: Logto @logto/tunnel path traversal in static file serving

Q: Which products and versions are affected?

Logto Tunnel <= 0.3.8; @logto/tunnel (npm) <= 0.3.8, SEMVER:introduced=0,fixed=0.3.9.

Q: Is there a fix for CVE-2026-63188?

Yes. @logto/tunnel (npm): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63188 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-63188?

Check whether you run Logto Tunnel or @logto/tunnel (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63188 · Severity: high · CVSS 4 · Published 2026-08-19

Logto's tunnel service is a CLI tool that serves custom authentication UI files from a specified directory. Due to inadequate path validation, an attacker on the network can craft requests using path traversal sequences (../) to read sensitive files stored on the same system where the tunnel is running, such as API keys, credentials, or environment secrets. This is particularly risky in development environments where the tunnel port may be exposed.

Vendors: Logto, npm.

Quick answers

Is CVE-2026-63188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63188 being exploited in the wild.
How severe is CVE-2026-63188?: High severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?: Logto Tunnel <= 0.3.8; @logto/tunnel (npm) <= 0.3.8, SEMVER:introduced=0,fixed=0.3.9.
Is there a fix for CVE-2026-63188?: Yes. @logto/tunnel (npm): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63188 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63188?: Check whether you run Logto Tunnel or @logto/tunnel (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@logto/tunnel (npm): upgrade to 0.3.9 or later
```
npm install @logto/tunnel@0.3.9
```

Technical details

The vulnerability is a path traversal flaw in @logto/tunnel's static file proxy implementation. The vulnerable code in packages/tunnel/src/commands/tunnel/utils.ts constructs filesystem paths by directly concatenating the request URL to the configured --experience-path using path.join(), then opens the resolved file with fs.open() without validating that the final path remains within the intended directory. An attacker can send an HTTP request with a URL like /../secret.txt, which resolves outside the static directory boundary and allows reading arbitrary files. The tunnel server binds to all network interfaces by default (server.listen(port)), making it reachable from the network. No authentication is required. A successful exploit results in arbitrary file read of any file accessible to the tunnel process, potentially exposing development secrets, API keys, or credentials stored near the custom UI project directory.

Affected products

Logto @logto/tunnel <= 0.3.8

Identifiers

CVE-2026-63188
GHSA-rxjr-6c9q-h67x

Timeline

2026-07-02: disclosed
2026-08-19: advisory
2026-08-19: patched: Fixed in version 0.3.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.