CVE-2026-108753

Summary

The Agnaistic agnai application contains hard-coded credentials in its Docker Compose configuration that sets a fixed admin password and public JWT secret. This allows unauthenticated attackers to gain administrative access or forge admin-level JWT tokens to impersonate users and modify server settings.

Exploitability

Exploitation is extremely easy with no prerequisites - attackers simply need to access the exposed Docker Compose configuration file to extract the hard-coded credentials and can immediately log in as admin or sign forged JWT tokens.

Blast radius

The impact could be severe across all installations using the vulnerable version, allowing attackers to fully compromise administrative access, reset user passwords, and modify critical server configurations without any authentication.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediately upgrade to version 1.0.556 or later to fix the hard-coded credentials vulnerability in self-host.docker-compose.yml.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.