Is CVE-2026-76760 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76760 being exploited in the wild.

How severe is CVE-2026-76760?

High severity, with a CVSS score of 7.3, published 19 August 2026.

Which products and versions are affected?

Chenhg5 Cc-Connect up to 1.4.1.

Is there a fix for CVE-2026-76760?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76760 attacked?

It is attacked over the network.

Am I affected by CVE-2026-76760?

Check whether you run Chenhg5 Cc-Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76760: chenhg5 cc-connect unauthenticated RCE in webhook

CVE-2026-76760 · Severity: high · CVSS 7.3 · Published 2026-08-19

cc-connect is a bridge tool that connects local AI coding agents to messaging platforms. The vulnerability allows attackers to execute arbitrary shell commands on servers running cc-connect without any authentication, by sending a simple HTTP request to the webhook endpoint. This can lead to complete system compromise, data theft, and ransomware deployment.

Technologies: Chenhg5 Cc-Connect. Vendors: Chenhg5.

Quick answers

Is CVE-2026-76760 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76760 being exploited in the wild.
How severe is CVE-2026-76760?: High severity, with a CVSS score of 7.3, published 19 August 2026.
Which products and versions are affected?: Chenhg5 Cc-Connect up to 1.4.1.
Is there a fix for CVE-2026-76760?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76760 attacked?: It is attacked over the network.
Am I affected by CVE-2026-76760?: Check whether you run Chenhg5 Cc-Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a code injection flaw (CWE-94) in the webhook authentication and command execution flow. The root cause consists of two chained issues: (1) the authenticate() function in core/webhook.go returns true when webhook.token is empty (the default configuration), intentionally disabling access control; (2) the handleHook() function passes user-controlled exec JSON fields directly to exec.CommandContext() in core/engine.go without sanitization. An unauthenticated remote attacker can POST arbitrary commands to the /hook endpoint, which are then executed on the server under the cc-connect process context. No authentication, special privileges, or user interaction is required. The exploit has been publicly disclosed with proof-of-concept code.

Affected products

chenhg5 cc-connect up to 1.4.1

Timeline

2026-07-03: disclosed: Issue #1488 opened on GitHub with PoC
2026-08-19: advisory: CVE-2026-76760 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.