Knowns Unauthenticated Management API Tunnel Exposure

Technical Analysis

CVE-2026-86543 stems from insecure-by-default configuration where the management API binds to 0.0.0.0 without requiring authentication, allowing any network-adjacent or internet-facing attacker to interact with privileged endpoints. The /api/tunnel/start endpoint is particularly dangerous as it allows an unauthenticated actor to provision an outbound tunnel, effectively converting a misconfigured internal service into a publicly reachable, fully controllable admin panel. Exploitation requires no authentication bypass technique—simply reaching the exposed port is sufficient, making this a high-severity, low-complexity attack vector suitable for automated mass exploitation and botnet integration. Given a CVSS score of 9.8, successful exploitation likely grants full administrative control over the host application, enabling data exfiltration, configuration tampering, or pivoting to other internal services. If Knowns is deployed as a management or orchestration layer for AI agent infrastructure (e.g., managing agent runtime configs, API keys, or tool-access tunnels), this vulnerability could allow attackers to exfiltrate LLM API keys, hijack agent tool-calling endpoints, or redirect agent network traffic through attacker-controlled tunnels.

Affected Systems

Knowns application versions prior to 0.30.0, specifically default/fresh installations where the management API is bound to all interfaces without authentication configured.

Indicators of Compromise

• Endpoint: /api/tunnel/start
• Unexpected outbound tunnel connections from Knowns hosts
• Unauthenticated inbound requests to management API ports on Knowns instances
• Unrecognized publicly accessible tunnel/proxy addresses linked to internal Knowns deployments

Remediation Steps

1. 1

   Upgrade to Knowns 0.30.0 or later

   Apply the vendor patch that enforces authentication on the management API by default and remove the unauthenticated tunnel provisioning path.

2. 2

   Restrict network exposure

   Bind the management API to localhost or internal-only interfaces via firewall rules; block external access to management ports until patched.

3. 3

   Enforce authentication on fresh installs

   Manually set a strong password/API key on the management interface immediately after deployment rather than relying on defaults.

4. 4

   Audit for unauthorized tunnels

   Review logs for any /api/tunnel/start invocations and inspect for unexpected public tunnel endpoints that may indicate prior compromise.

5. 5

   Rotate exposed credentials

   If the instance manages API keys or secrets (including LLM/agent tool credentials), rotate them immediately assuming potential exposure.