Is CVE-2026-76761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76761 being exploited in the wild.

How severe is CVE-2026-76761?

High severity, with a CVSS score of 7.3, published 19 August 2026.

Which products and versions are affected?

Chenhg5 Cc-Connect up to 1.4.1.

Is there a fix for CVE-2026-76761?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76761 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76761?

Check whether you run Chenhg5 Cc-Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76761: chenhg5 cc-connect OS command injection in Management API

CVE-2026-76761 · Severity: high · CVSS 7.3 · Published 2026-08-19

cc-connect is a bridge application that connects local AI coding agents to messaging platforms. The Management API contains an authentication bypass combined with OS command injection that allows unauthenticated attackers to execute arbitrary commands on the server by creating malicious cron jobs. This enables full server compromise, data theft, and lateral movement into internal networks.

Technologies: Chenhg5 Cc-Connect. Vendors: Chenhg5.

Quick answers

Is CVE-2026-76761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76761 being exploited in the wild.
How severe is CVE-2026-76761?: High severity, with a CVSS score of 7.3, published 19 August 2026.
Which products and versions are affected?: Chenhg5 Cc-Connect up to 1.4.1.
Is there a fix for CVE-2026-76761?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76761 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76761?: Check whether you run Chenhg5 Cc-Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a chained authentication bypass (CWE-306) and OS command injection (CWE-78) in the Management API. The authenticate() function returns true when management.token is empty (the default configuration), bypassing all authentication checks. Unauthenticated attackers can POST to /api/v1/cron to create cron jobs with user-controlled exec parameters that are executed as shell commands via shellExecCommand() in core/engine.go. Attack vector is network-based with no authentication or user interaction required. Successful exploitation grants arbitrary command execution with the privileges of the cc-connect process. The issue is publicly disclosed with working proof-of-concept code available.

Affected products

chenhg5 cc-connect up to 1.4.1

Timeline

2026-07-03: disclosed: GitHub issue #1489 opened with full vulnerability disclosure
2026-08-19: disclosed: CVE-2026-76761 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.