CRITICAL 9.3 NVD
CVE-2026-108753
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JW
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.
References
- https://github.com/agnaistic/agnai
- https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/README.md
- https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/self-host
- https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/srv/api/a
- https://hackmd.io/@haind/agnai-selfhost-compose-hardcoded-admin-jwt-secret
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-11 via NVD.
Risk Timeline
CVE Disclosed2026-10-11 · 0 days ago
Remediation Resources
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.