Critical Auth Bypass in cc-connect Webhooks Allows Remote Privileged Command Execution

A critical missing authentication vulnerability in cc-connect allows remote attackers to execute privileged commands on vulnerable hosts without valid credentials. The flaw, identified as CVE-2026-108549, affects all versions of the software up to and including 1.5.0, according to the National Vulnerability Database record.

At a glance

CVE

CVE-2026-108549

Product

chenhg5 cc-connect

CVSS

9.2 Critical

Weakness

missing authentication

Exploited

No known exploitation

The National Vulnerability Database rates CVE-2026-108549 as Critical with a CVSS score of 9.2. The weakness stems from CWE-306, which describes missing authentication for a critical function. In the MAX platform adapter webhook mode, the application accepts updates from remote sources without verifying identity when no webhook_secret is configured.

Context and Background

The vulnerability resides specifically within the platform/max/max.go source file of the cc-connect application. When the webhook listener on port 8080 is active, it processes incoming requests without enforcing authentication checks if the secret parameter is absent. This configuration allows any remote actor with network access to the port to interact with the system directly.

Attackers can exploit this gap by forging update messages that include an allowed or admin user_id. Because the system trusts these forged identities, it processes the requests as legitimate administrative actions. This capability enables the execution of privileged commands, such as /shell, directly on the host machine running the service.

Who Is Affected

The chenhg5 cc-connect product is affected by this vulnerability in all releases up to version 1.5.0. Organizations using the MAX platform adapter webhook mode are at the highest risk if they have not configured a webhook_secret. Any instance exposing port 8080 to untrusted networks is potentially accessible to remote attackers.

Administrators should verify their current cc-connect version immediately to determine if they fall within the affected range. Systems running version 1.5.0 or earlier require immediate attention to mitigate the risk of unauthorized command execution. The lack of a confirmed patch means exposure remains high for unpatched installations.

What should you do?

Security teams should audit their networks for active cc-connect instances listening on port 8080. Identify any configurations where webhook_secret is left empty or unset, as these are immediately exploitable. Monitor logs for unusual command executions or shell access attempts originating from the webhook listener to detect active exploitation.

What to do and how to stay safe: cc-connect

• Restrict network access to port 8080 to trusted internal IP ranges only using firewall rules.
• Ensure a strong, unique webhook_secret is configured for all webhook endpoints to enforce authentication.
• Monitor system logs for unexpected execution of privileged commands like /shell from the cc-connect process.
• Verify current software versions and prepare to apply updates once the vendor releases a confirmed fix.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108549?

The National Vulnerability Database rates CVE-2026-108549 as Critical with a CVSS score of 9.2.

Which versions of cc-connect are affected by this vulnerability?

All versions of cc-connect up to and including 1.5.0 are affected by this missing authentication flaw.

How can attackers exploit this vulnerability?

Attackers can forge updates with admin user IDs on port 8080 to run privileged commands like /shell on the host.