External risk intelligence

mpush Gateway Server Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-79574

The vulnerability exists in a gateway server, which is a component typically deployed at the network edge to manage traffic. As an internet-facing gateway service designed to handle broadcast messages, it is commonly exposed to external networks in real-world deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability discovered in the gateway server of mpush, a component that could allow unauthorized individuals to execute arbitrary code by sending a specially crafted message. The technology's network-facing nature and the potential for remote code execution are key concerns. The main concern is confirming relevance and exposure.

A gateway server flaw allows code execution.
Critical flaw poses a high execution risk.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted broadcast message to the mpush gateway server. This server, designed to handle such messages, has an issue that allows malicious input to trigger arbitrary code execution. The vulnerability could lead to a complete compromise of the server.

No special access required.
Crafted broadcast message triggers vulnerability.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the mpush gateway server could allow an attacker to execute arbitrary code by sending a specially crafted broadcast message. This could affect the availability and integrity of the server when this feature is enabled.

Gateway server and its functions.
Sending a crafted broadcast message.
Arbitrary code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical vulnerability in the mpush gateway server requires immediate attention from teams responsible for its operation and security. The first practical step is to ascertain the presence and exposure of mpush within your environment, confirm its business criticality, identify the accountable system owner, and then meticulously plan remediation based on the assessed risk.

Application and infrastructure owners should lead.
Verify mpush gateway exposure and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mpush and what does its gateway server do?

mpush is an open-source push notification system designed for real-time messaging. Its gateway server component acts as a central communication hub, managing and distributing broadcast messages to connected clients. It is the critical traffic-handling engine that ensures data reaches the intended recipients across the network.

What does CWE-94 mean for CVE-2026-79574?

CWE-94 refers to improper control of generation of code. In the context of this vulnerability, it means the mpush gateway server does not sufficiently sanitize or validate incoming broadcast messages. Because the software treats parts of these messages as executable instructions, an attacker can supply specially crafted data that the system mistakenly runs as if it were legitimate internal code.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically formatted broadcast message to the gateway server. No authentication or special user privileges are required to initiate this process. Importantly, the vulnerability is not triggered by standard, well-formed broadcast traffic; it requires the inclusion of malicious, malformed data specifically designed to exploit the server's message processing logic.

Do I need to worry if my mpush instance is internal?

Halo Surface Signal indicates that because mpush gateway servers are designed to handle broadcast traffic, they are frequently deployed at the network edge to communicate with various endpoints. While an internet-facing deployment significantly increases risk due to remote accessibility, any internal system reachable by other compromised or malicious network assets may still be vulnerable.

What should I do if I run mpush?

Start by identifying all instances of mpush within your environment and determining their specific network connectivity and purpose. Locate the system owners responsible for these servers to assess their business criticality. Once mapped, prioritize these systems for remediation planning, focusing on those with the highest exposure to network traffic while you await official guidance or updates.

References

github.com/fangtang7/CVE/blob/main/mpush/rce.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.