CVE-2026-57951: Incorrect Authorization in its-a-feature Mythic
Mythic versions prior to 3.4.0.60 have an authorization vulnerability due to a broken Hasura permission filter on the payload_build_step table. This flaw allows authenticated operators and spectators to bypass operation-scoped access controls and read sensitive fields such as step_stdout, step_stderr, step_name, and step_description across all operations on the server.
AI Analysis
Technical Summary
CVE-2026-57951 is an authorization bypass vulnerability in Mythic before version 3.4.0.60. The issue stems from a broken Hasura permission filter on the payload_build_step table, where an always-satisfied _or condition bypasses operation-scoped access controls. As a result, authenticated users with operator or spectator roles can query and access sensitive step data across all operations, which should normally be restricted.
Potential Impact
Authenticated operators and spectators can read sensitive information from the payload_build_step table across all operations on the server, including step_stdout, step_stderr, step_name, and step_description. This unauthorized data access could lead to information disclosure within the Mythic environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to authenticated operator and spectator roles and monitor for unusual access patterns to mitigate potential exposure.
CVE-2026-57951: Incorrect Authorization in its-a-feature Mythic
Description
Mythic versions prior to 3.4.0.60 have an authorization vulnerability due to a broken Hasura permission filter on the payload_build_step table. This flaw allows authenticated operators and spectators to bypass operation-scoped access controls and read sensitive fields such as step_stdout, step_stderr, step_name, and step_description across all operations on the server.
CVSS v4.0
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-57951 is an authorization bypass vulnerability in Mythic before version 3.4.0.60. The issue stems from a broken Hasura permission filter on the payload_build_step table, where an always-satisfied _or condition bypasses operation-scoped access controls. As a result, authenticated users with operator or spectator roles can query and access sensitive step data across all operations, which should normally be restricted.
Potential Impact
Authenticated operators and spectators can read sensitive information from the payload_build_step table across all operations on the server, including step_stdout, step_stderr, step_name, and step_description. This unauthorized data access could lead to information disclosure within the Mythic environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to authenticated operator and spectator roles and monitor for unusual access patterns to mitigate potential exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-26T13:57:16.356Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a42b42827e9c7971940f859
Added to database: 06/29/2026, 18:06:32 UTC
Last enriched: 06/29/2026, 18:21:25 UTC
Last updated: 06/29/2026, 18:27:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.