Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Agnai up to 1.0.555 ships with default admin password

CVE-2026-108753 · published 7 days ago
Summary

The self‑hosted Docker setup for Agnai includes a fixed admin password and a public token secret. Because these values are hard‑coded, anyone can log in as an administrator, change settings, or impersonate users. Update to a newer release and replace the default password and token secret with strong, unique values as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
agnaistic agnai <= 1.0.555
Original advisory text
Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Sources
CVE-2026-108753 · NVD
CVE-2026-108753 · MITRE
Track software like this
Free during beta