# CVE-2026-76760: chenhg5 cc-connect unauthenticated RCE in webhook

Source: https://junglewise.ai/threats/cve-2026-76760-chenhg5-cc-connect-unauthenticated-rce-in-webhook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76760 · Severity: high · CVSS 7.3 · Published 2026-08-19

cc-connect is a bridge tool that connects local AI coding agents to messaging platforms. The vulnerability allows attackers to execute arbitrary shell commands on servers running cc-connect without any authentication, by sending a simple HTTP request to the webhook endpoint. This can lead to complete system compromise, data theft, and ransomware deployment.

Technologies: [Chenhg5 Cc-Connect](https://junglewise.ai/threats/technologies/cc-connect). Vendors: [Chenhg5](https://junglewise.ai/threats/vendors/chenhg5).

## Quick answers

**Is CVE-2026-76760 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76760 being exploited in the wild.

**How severe is CVE-2026-76760?** High severity, with a CVSS score of 7.3, published 19 August 2026.

**Which products and versions are affected?** Chenhg5 Cc-Connect up to 1.4.1.

**Is there a fix for CVE-2026-76760?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76760 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76760?** Check whether you run Chenhg5 Cc-Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw (CWE-94) in the webhook authentication and command execution flow. The root cause consists of two chained issues: (1) the authenticate() function in core/webhook.go returns true when webhook.token is empty (the default configuration), intentionally disabling access control; (2) the handleHook() function passes user-controlled exec JSON fields directly to exec.CommandContext() in core/engine.go without sanitization. An unauthenticated remote attacker can POST arbitrary commands to the /hook endpoint, which are then executed on the server under the cc-connect process context. No authentication, special privileges, or user interaction is required. The exploit has been publicly disclosed with proof-of-concept code.

## Affected products

- chenhg5 cc-connect up to 1.4.1

## Timeline

- 2026-07-03: disclosed: Issue #1488 opened on GitHub with PoC
- 2026-08-19: advisory: CVE-2026-76760 published

## References

- [https://github.com/chenhg5/cc-connect/](https://github.com/chenhg5/cc-connect/)
- [https://github.com/chenhg5/cc-connect/issues/1488](https://github.com/chenhg5/cc-connect/issues/1488)

## Related threats

- [cc-connect missing authentication in MAX platform adapter webhook](https://junglewise.ai/threats/cve-2026-108549-cc-connect-through-1-5-0-contains-a-missing-authentication)
- [chenhg5 cc-connect OS command injection in Management API](https://junglewise.ai/threats/cve-2026-76761-chenhg5-cc-connect-os-command-injection-in-management-api)