Listen to this Post
The AnyCable realtime server before version 1.6.15 embeds a hardcoded authentication token, authToken = "secret", in its publicly available source code at `telemetry/config.go` line 12. This token is used to authenticate telemetry data sent to the third-party endpoint https://telemetry.anycable.io`. Separately, the `clusterFingerprint()` function in `telemetry/telemetry.go` (line 320) calls `anycableFileConfig()` (line 333) and `anycableCLIArgs()` (line 402). The first reads the entire TOML configuration file, while the second reads `os.Args[1:]` verbatim. This means command-line arguments such as–secret=…,–jwt_secret=…`, and `–http_rpc_secret=…` are captured in their raw form. Both the full configuration file contents and the raw CLI arguments are then passed to `generateDigest()` (line 373), where a SHA-256 hash is produced. The resulting digest becomes part of the telemetry payload. Because the authentication token is publicly known and the telemetry endpoint is a fixed domain, an attacker who can perform DNS hijacking or is positioned on the network path can intercept the telemetry POST request. The intercepted payload contains the fingerprint derived from secret-bearing configuration and CLI arguments, exposing production JWT secrets, broadcast keys, and RPC authentication material to the attacker. The hardcoded token provides no confidentiality protection since it is visible to anyone who reads the open-source repository. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information) and CWE-798 (Use of Hard-coded Credentials). The issue was publicly disclosed on 2026-09-18 via the GitHub Security Advisory GHSA-w72w-9qmj-c9qm.
DailyCVE Form
Platform: AnyCable
Version: < 1.6.15
Vulnerability: CVE-2026-63406
Severity: Medium
date: 2026-09-18
Prediction: 2026-06-29
What Undercode Say
Analytics
Bash
curl -s https://raw.githubusercontent.com/anycable/anycable/master/telemetry/config.go | grep authToken
Bash
DNS spoof for telemetry.anycable.io to attacker-controlled server Then start anycable-go with a secret-bearing flag anycable-go --secret=my-production-secret
Bash
The resulting telemetry POST contains a clusterFingerprint field derived from raw os.Args, including the --secret value
Exploit: (Educational Purposes!)
Bash
1. Read telemetry/config.go in the public repo to find authToken = "secret" 2. Set up a DNS spoof for telemetry.anycable.io pointing to an attacker-controlled server 3. Start anycable-go with --secret=my-production-secret 4. The server sends a POST to the attacker's endpoint with the telemetry JSON payload 5. The clusterFingerprint field contains data derived from raw os.Args including --secret=my-production-secret
Protection: from this CVE
Bash
Upgrade AnyCable to version 1.6.15 or later go get github.com/anycable/[email protected]
Bash
Disable telemetry by setting the environment variable export ANYCABLE_DISABLE_TELEMETRY=true
Bash
Remove the hardcoded authToken from source; generate or require operator configuration at build time or deployment time Remove anycableCLIArgs() from the fingerprint computation, or sanitize it to exclude values of secret-bearing flags before hashing Add a documented opt-out mechanism for telemetry
Impact:
In MITM/DNS-hijack scenarios, production secrets (JWT secrets, broadcast keys, RPC auth) are exposed to third parties. The hardcoded `authToken = “secret”` provides no protection since it is known to anyone reading the open-source code.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
