CVE-2026-86543: knowns management API authentication bypass

Executive brief

knowns is a tool for creating secure tunnels and managing network access. Versions before 0.30.0 expose the management API without any authentication on all network interfaces by default, allowing anyone with network access to start tunnels and republish the API publicly. An attacker can abuse this to gain unauthorized control over the application and potentially redirect traffic or compromise connected services.

Technical details

The vulnerability is an authentication bypass in the management API service. The management API endpoints, including /api/tunnel/start, are served without authentication checks on fresh installations (no password configured by default). The AuthManager component exists but is not enforced on API routes before version 0.30.0. An attacker with network access to the management API can directly invoke unauthenticated endpoints to provision public tunnels and republish the API at a publicly accessible address. The fix is available in version 0.30.0 and later, which enforces authentication on the management API by default.

Affected products

• knowns-dev knowns before 0.30.0

Timeline

• 2026-09-07: disclosed

References

• https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go
• https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go