Cross-Origin Request Exposure in LoopX Control Plane by LoopX
CVE-2026-108372

7.1HIGH

Key Information:

Vendor

Huangruiteng

Status
Loopx
Vendor
CVE Published:
16 October 2026

What is CVE-2026-108372?

LoopX, a lightweight state kernel and local-first control plane for loop engineering, is affected by a cross-origin request exposure vulnerability. The issue occurs in the loopx/status_server.py file, where the loopx serve-status command responds with Access-Control-Allow-Origin: * for unauthenticated requests made to specific endpoints. Attackers can exploit this vulnerability through crafted web content that directs operators to make cross-origin requests, thereby exposing sensitive control-plane information, such as goal and run details, local file paths, and configurations. The vulnerability has been addressed in version 0.4.5.

Affected Version(s)

loopx >= 0.0.1, < 0.4.5

References

https://github.com/loopx-project/loopx/security/advisorie...
x_refsource_CONFIRM
https://github.com/loopx-project/loopx/pull/3137
x_refsource_MISC
https://github.com/loopx-project/loopx/commit/838720fba42...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.