Is CVE-2026-86544 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86544 being exploited in the wild.

How severe is CVE-2026-86544?

High severity, with a CVSS score of 8.1, published 7 September 2026.

Is there a fix for CVE-2026-86544?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86544 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86544?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86544: Knowns authorization bypass via code.replace mutation

CVE-2026-86544 · Severity: high · CVSS 8.1 · Published 2026-09-07

Knowns is an AI project management system with permission controls to restrict user capabilities. A vulnerability in versions before 0.30.0 allows users granted read-only access to exploit the code.replace action to modify permission configurations and escalate their privileges to write or admin capabilities. An attacker with limited read-only access could gain unauthorized control over the system.

Quick answers

Is CVE-2026-86544 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86544 being exploited in the wild.
How severe is CVE-2026-86544?: High severity, with a CVSS score of 8.1, published 7 September 2026.
Which products and versions are affected?: Knowns Knowns before 0.30.0.
Is there a fix for CVE-2026-86544?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86544 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86544?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the permissions guard middleware. Mutating code actions, specifically code.replace, are incorrectly classified as read-only (CapRead) instead of write (CapWrite) operations in the ActionRegistry. Attackers with read-restricted sessions can call code.replace to modify permission configurations, then escalate privileges on subsequent actions. The issue is in the ActionMeta classification logic in internal/permissions/registry.go. Fix: upgrade to version 0.30.0 or later, which reclassifies code.replace as a write capability and implements stricter validation of permission-modifying operations.

Affected products

Knowns Knowns before 0.30.0

Timeline

2026-09-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.