External risk intelligence

Dalfox Server Unauthenticated Arbitrary Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-45087

The vulnerability affects Dalfox when run in REST API server mode. The application defaults to binding the server to 0.0.0.0, making it reachable on all network interfaces, and operates without mandatory authentication by default. This design makes the service inherently public-facing and unauthenticated when deployed as intended in server mode, exposing the API endpoint directly to network callers.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Dalfox, an open-source tool used for scanning and automation. When Dalfox is configured as a REST API server, it can be exploited by unauthenticated attackers to execute arbitrary commands on the host system. The primary concern is to confirm if this specific tool is in use and, if so, to ascertain its exposure.

Unauthenticated attackers can run commands remotely.
Leadership should remember this if Dalfox is in use.
Confirm Dalfox usage and network exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the Dalfox REST API server if it's running and accessible on the network. By sending a specially crafted JSON payload to the `/scan` endpoint, an unauthenticated user can cause Dalfox to execute arbitrary commands on the host system whenever a scan result is found. This command execution can be triggered by anyone who can access the server port.

No authentication required.
Sending crafted JSON to `/scan` endpoint.
Arbitrary command execution on host.

Live Threat

Current exploitation, exposure, and threat context

When Dalfox is operating in REST API server mode without an API key, an unauthenticated caller can send specially crafted JSON to the server. This could lead to arbitrary shell commands being executed on the host system when a scan finding is triggered, impacting the server's services and potentially its underlying operating system.

Server host system and its services
Unauthenticated network access to API
Arbitrary code execution on server

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Dalfox's REST API server mode requires immediate attention from the platform or application teams responsible for its deployment. The first step is to identify all instances of Dalfox running in server mode, determine their network accessibility, and assess their business criticality. Once identified, the accountable owner must be located to initiate a risk-based remediation plan.

Platform or application teams own the issue.
Verify Dalfox API server network exposure.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dalfox?

Dalfox is an open-source utility designed to automate Cross-Site Scripting (XSS) detection and security scanning. Developers and security teams use it to streamline the identification of vulnerabilities in web applications. The software includes a REST API server mode that allows users to trigger and manage scans remotely via network requests.

What is the vulnerability in CVE-2026-45087?

This vulnerability is classified as Improper Neutralization of Special Elements used in an OS Command (CWE-78), alongside missing authentication issues. In affected versions, the Dalfox API server fails to validate incoming JSON input. Consequently, an attacker can supply malicious commands that the server executes on the host machine whenever a scan finding occurs.

How is this command execution triggered?

An attacker triggers the vulnerability by sending a specifically crafted JSON payload to the /scan endpoint of a running Dalfox server. The bug is not triggered by standard scanning operations; it requires the server to be running in REST API mode without an API key. If a valid API key is configured by the operator, the unauthorized path is effectively blocked.

Is my instance of Dalfox at risk?

According to Halo Surface Signal, instances are highly susceptible if they are running in server mode with default settings. Because the service defaults to binding to all network interfaces (0.0.0.0) without mandatory authentication, it may be reachable by unauthorized callers over the network. You should prioritize checking any Dalfox server deployments that are accessible beyond a local, isolated environment.

Do I need to update Dalfox immediately?

Yes, if you use Dalfox in REST API server mode, you should prioritize upgrading to version 2.13.0 or later, which resolves the command execution flaw. Your first step is to inventory all active Dalfox server processes, confirm their network reachability, and coordinate with your internal teams to apply the update or restrict access to the API port.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.