Executive brief
AnyCable's telemetry system contains a hardcoded authentication token and inadvertently transmits sensitive secrets (JWT keys, broadcast keys, RPC credentials) to a third-party endpoint. An attacker positioned on the network or controlling DNS can intercept these telemetry payloads to steal production credentials, compromising message authentication and system security.
Technical details
AnyCable's telemetry subsystem embeds a hardcoded authentication token ("secret") in the public source code and uses it to authenticate to telemetry.anycable.io. The fingerprinting logic reads raw CLI arguments via os.Args[1:] including values for --secret, --jwt_secret, and --http_rpc_secret flags without sanitization, then transmits these in telemetry payloads. An attacker capable of DNS hijacking or network interception can exploit the known hardcoded token to intercept and decrypt telemetry data, exposing production secrets. The vulnerability requires network positioning (MITM/DNS hijack) but affects all operators running vulnerable versions. No patch availability is stated in the advisory.
Affected products
- AnyCable AnyCable <UNKNOWN>
Timeline
- 2026-09-18: disclosed
- 2026-09-18: advisory: CVE-2026-63406