Executive brief
MeshCentral is a remote management platform used to monitor and control computers and devices over the internet. A security flaw in how the software verifies web connections allows an attacker to hijack an administrator's session if the server uses self-signed security certificates. If exploited, an attacker could gain full remote control over all devices managed by the server, potentially leading to data theft or unauthorized access to corporate infrastructure.
Technical details
A Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in MeshCentral due to an origin validation error in the CheckWebServerOriginName() function within webserver.js. When self-signed certificates are used, the function performs an unconditional early return of 'true', effectively bypassing origin checks. An unauthenticated remote attacker can entice an authenticated user to visit a malicious site, which then opens cross-origin WebSocket connections to the MeshCentral server. This allows the attacker to exfiltrate the server's sessionKey, forge session tokens for any user, and achieve full administrative control over the instance and its managed endpoints. The issue was addressed in June 2026 by replacing direct certificate CommonName comparisons with a more robust hostname validation method.
Affected products
- Ylianst MeshCentral 1.1.21 and earlier
Timeline
- 2026-06-08: patched: Fix merged into master branch via pull request 7882
- 2026-07-30: disclosed: CVE-2026-66420 published