Missing Authentication Vulnerability in AiSOC by Beenuar

CVE-2026-103053

What is CVE-2026-103053?

AiSOC versions prior to 12.0.0 exhibit a serious flaw where authentication is not enforced for the response-action API endpoints. This issue arises specifically when AISOC_DEV_MODE is enabled and the AISOC_ACTIONS_SERVICE_TOKEN is left empty, as seen in the default Docker Compose deployment. As a result, malicious actors could exploit this lack of authentication to list response-action integrations, submit and approve actions under arbitrary principals, and issue containment actions using vendor credentials, creating significant risks for users and their systems.

References