CVE-2026-103053: Missing Authentication for Critical Function in beenuar AiSOC
AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
AI Analysis
Technical Summary
CVE-2026-103053 describes a missing authentication vulnerability in beenuar AiSOC versions >=9.0.0 and <12.0.0. The flaw occurs when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment, allowing unauthenticated attackers to access response-action API endpoints. This enables attackers to list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
Potential Impact
The vulnerability allows unauthenticated attackers to perform critical functions such as listing integrations, submitting and approving actions, and dispatching containment actions with vendor credentials. This could lead to unauthorized control over response actions within the AiSOC environment, potentially impacting system integrity and response workflows.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling AISOC_DEV_MODE with an empty AISOC_ACTIONS_SERVICE_TOKEN in production environments.
CVE-2026-103053: Missing Authentication for Critical Function in beenuar AiSOC
Description
AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
CVSS v4.0
Score 5.3medium
Affected software
beenuar
AiSOC
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103053 describes a missing authentication vulnerability in beenuar AiSOC versions >=9.0.0 and <12.0.0. The flaw occurs when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment, allowing unauthenticated attackers to access response-action API endpoints. This enables attackers to list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
Potential Impact
The vulnerability allows unauthenticated attackers to perform critical functions such as listing integrations, submitting and approving actions, and dispatching containment actions with vendor credentials. This could lead to unauthorized control over response actions within the AiSOC environment, potentially impacting system integrity and response workflows.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling AISOC_DEV_MODE with an empty AISOC_ACTIONS_SERVICE_TOKEN in production environments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-29T23:34:43.109Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abc5d2e680226ef6899b9dd
Added to database: 09/30/2026, 00:51:58 UTC
Last enriched: 09/30/2026, 01:22:09 UTC
Last updated: 09/30/2026, 03:03:50 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.