Agnaistic agnai 1.0.555 Vulnerable to Critical Hardcoded Credential Flaw
A critical vulnerability in Agnaistic agnai allows unauthenticated attackers to gain admin access via hardcoded credentials and JWT secrets.
Key points
- CVE-2026-108753 carries a CVSS score of 9.3, rated critical severity.
- The flaw affects Agnaistic agnai versions up to and including 1.0.555.
- Attackers can impersonate users, reset passwords, and alter server configurations.
A critical security vulnerability has been identified in Agnaistic agnai, a software product that ships with hardcoded administrative credentials. The flaw, tracked as CVE-2026-108753, allows unauthenticated attackers to gain full administrative control over affected systems without needing to guess or steal passwords.
At a glance
- CVE
- CVE-2026-108753
- Product
- agnaistic agnai
- CVSS
- 9.3 Critical
- Weakness
- hard-coded credentials
- Exploited
- No known exploitation
The vulnerability stems from the self-host.docker-compose.yml configuration file, which contains a fixed admin password and a public JSON Web Token (JWT) secret. According to the National Vulnerability Database record, this design error enables attackers to log in directly as an administrator or sign their own JWT tokens with elevated privileges.
Technical Context and Impact
The issue is classified under CWE-798, which relates to use of hardcoded credentials. The vulnerability allows an attacker to set the admin flag to true within a signed JWT. This capability permits the impersonation of any user, including system administrators, without possessing valid login credentials.
Attackers exploiting this flaw can perform a range of malicious actions. They can reset user passwords, effectively locking out legitimate users, and change server configuration settings. This level of access compromises the integrity and confidentiality of the entire application environment.
Affected Versions and Scope
The vulnerability affects all versions of Agnaistic agnai up to and including version 1.0.555. Systems running these versions are exposed if they utilize the default self-hosted Docker Compose configuration. The flaw is present in the deployment files rather than the core application logic, suggesting a configuration oversight during development.
No patched version has been confirmed yet. Users running version 1.0.555 or earlier are advised to assume their systems are compromised if exposed to the internet. The critical CVSS score of 9.3 reflects the ease of exploitation and the severe impact on system security.
What should you do?
Organizations using Agnaistic agnai should immediately audit their deployment configurations. Check for the presence of the self-host.docker-compose.yml file and verify that no hardcoded credentials remain in any configuration files. Monitor server logs for unauthorized administrative actions or unusual JWT token generation.
What to do and how to stay safe: Agnaistic
- Review deployment configuration files for hardcoded passwords or secrets.
- Rotate all administrative passwords and JWT secrets immediately.
- Monitor server logs for unauthorized login attempts or configuration changes.
- Restrict network access to the application to trusted IP ranges only.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108753?
The CVSS score is 9.3, which is rated as critical severity.
Which versions of Agnaistic agnai are affected?
Versions up to and including 1.0.555 are affected by this vulnerability.
How can attackers exploit this vulnerability?
Attackers can use hardcoded credentials or sign their own JWT tokens to gain admin access.
