Quick answers
- Is CVE-2026-89186 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89186 being exploited in the wild.
- How severe is CVE-2026-89186?
- Informational severity, with a CVSS score of 0, published 16 September 2026.
- Which products and versions are affected?
- ZenHive Mpp 0.1.0 to 0.16.1.
- Is there a fix for CVE-2026-89186?
- A patch was published on 2026-09-16: Fix available in version 0.16.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-89186 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-89186?
- Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in MPP.Plug.verify_credential (lib/mpp/plug.ex), which sets cache-control: private to prevent caching of paid responses. However, the library fails to register a register_before_send/2 callback, allowing downstream applications to silently override the cache-control header using Plug.Conn.put_resp_header/3. An attacker (or misconfigured application) can set cache-control: public with a long max-age, allowing CDNs and reverse proxies to cache the paid response along with its Payment-Receipt and serve both to unauthenticated clients. Additionally, non-2xx responses incorrectly retain the Payment-Receipt header, issuing false payment receipts. Attack requires network access to the application and ability to control downstream caching behavior or exploit misconfigured headers. The vulnerability affects mpp versions 0.1.0 through 0.16.1; version 0.16.2+ contains the fix.
Affected products
- ZenHive mpp 0.1.0 to 0.16.1
Timeline
- 2026-09-16: disclosed: CVE-2026-89186 published
- 2026-09-16: patched: Fix available in version 0.16.2