Information Disclosure in elizaOS HTTP Server by eliza
CVE-2026-124587

5.3MEDIUM

Key Information:

Vendor

Elizaos

Status
Eliza
Vendor
CVE Published:
9 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124587?

A vulnerability has been discovered in the HTTP Server component of elizaOS, specifically in the unknown function located in the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts. This flaw allows unauthorized access to sensitive information, potentially leading to a breach of confidentiality. The vulnerability can be exploited remotely, utilizing publicly available attack methods. To mitigate this risk, it is essential to apply the patch identified as cf6fa193017e70884e01c5bb7890f74b6b2b79d2 as soon as possible.

Affected Version(s)

eliza 2.0.3-beta.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124587 - Proof of Concept

References

https://vuldb.com/vuln/433011
vdb-entry
https://vuldb.com/vuln/433011/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124587
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

akamoli (VulDB User)
.