CVE-2026-111643

Summary

The Misaka Danmu Server contains an authentication bypass vulnerability in its configuration API that allows unauthenticated attackers to modify critical configuration settings like IP whitelists and trusted proxies, effectively granting them administrative access to the entire system.

Exploitability

Exploitation is straightforward requiring only a single POST request to the unprotected /api/ui/config-history/rollback endpoint with crafted configuration data, with no authentication or additional preconditions needed.

Blast radius

The vulnerability could allow attackers to completely compromise the server by gaining administrative access to all protected endpoints, potentially leading to full system takeover and unauthorized configuration of network access controls.

Detection

Monitor for POST requests to /api/ui/config-history/rollback endpoint with suspicious configuration changes, particularly modifications to ipWhitelist, trustedProxies, and webhookApiKey fields in server logs.

Prioritized remediation

Upgrade to version 2.8.10 or later to address this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.