External risk intelligence

Knowns Management API Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-86543

The product defaults to exposing its management API on all network interfaces without authentication. Because it is designed to be accessible to facilitate tunnel provisioning and API re-publishing, it is inherently public-facing by design in default, fresh deployments.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a management API that, in some versions before 0.30.0, can be accessed without authentication on all network interfaces by default, allowing attackers to provision public tunnels and republish the API.

Unauthenticated API access exposes management functions.
Important for potential unauthorized tunnel creation.
Confirm if this system is used and confirm version.

Attack Path

How an attacker could exploit the issue

An attacker could begin by targeting a system with an unauthenticated management API exposed on the network. Accessing the specific `/api/tunnel/start` endpoint allows the attacker to create a public tunnel, effectively re-publishing the API at a publicly accessible address. This vulnerability can lead to significant security risks when successfully triggered.

No authentication required for API.
Provision public tunnel via API.
High impact on confidentiality and integrity.

Live Threat

Current exploitation, exposure, and threat context

Newer versions of this product, when installed fresh, may expose its management API without requiring a password on all network interfaces. This could allow an attacker to provision a public tunnel and re-publish the API at a publicly accessible address.

The management API and tunnel provisioning.
Accessing an unauthenticated endpoint.
Publicly accessible API and tunnel provisioning.

Operational Fix

Recommended remediation, mitigation, and detection steps

The technical product owner or platform team is likely responsible for managing this technology, as it exposes an unauthenticated management API. The first step is to identify all instances of this technology, confirm their exposure and business criticality, and then determine the accountable owner for remediation.

Determine technology ownership and scope.
Verify API reachability and business impact.
Plan and coordinate remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Knowns software?

Knowns is a utility designed to manage network tunnels and service provisioning. It typically acts as a bridge, allowing users to make internal services or APIs accessible remotely by creating tunnels. The software includes a management API to handle these configurations programmatically. Because its core purpose is to facilitate connectivity and traffic routing, it is often deployed in environments where network accessibility is a primary function.

How does CWE-306 apply to CVE-2026-86543?

CVE-2026-86543 relates to CWE-306: Missing Authentication for Critical Function. In plain terms, this means the software performs sensitive management tasks without verifying the identity of the user. Because the application fails to check for credentials before executing requests, any entity with network reach to the management API can trigger administrative actions, effectively bypassing all intended security controls for those specific functions.

What triggers this vulnerability?

The vulnerability is triggered by sending a request to the specific '/api/tunnel/start' endpoint. Because the API is unauthenticated by default, no special login or token is required to execute this command. It is important to note that this bug is not triggered by standard traffic passing through an existing, authorized tunnel; rather, it is triggered by interacting directly with the management interface to initiate new, unauthorized tunnel provisioning.

Why does Halo Surface Signal categorize this as high risk?

Halo Surface Signal labels this as high risk because the software defaults to exposing its management API on all network interfaces. Since the system is designed to facilitate tunnel creation, these management functions are often inherently reachable over the network in fresh deployments. This default configuration means that without additional manual hardening, the API's critical functions are potentially accessible to anyone who can reach the server over the network.

How do I secure my environment against this CVE?

The first step is to identify all running instances of the software and verify their current version. If you are using a version earlier than 0.30.0, you are affected by this authentication gap. Coordinate with the team responsible for managing these services to plan an immediate upgrade. While preparing for the update, verify the network reachability of these management interfaces and restrict access to authorized users or private network segments to minimize immediate risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.