{"schema":"vulnpedia.research/1","cve":"CVE-2026-108856","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/unicomai-wanwu-mcp-key-arbitrary-resource","tags":["third-party-advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/unicomai-wanwu-mcp-key-arbitrary-resource"},{"source":"nvd","sourceId":"CVE-2026-108856","modified":"2026-10-16T19:18:44.867","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/unicomai-wanwu-mcp-key-arbitrary-resource"}]},{"url":"https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/app-service/client/orm/app_key.go#L37-L49","tags":["technical-description"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","url":"https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/app-service/client/orm/app_key.go#L37-L49"},{"source":"nvd","sourceId":"CVE-2026-108856","modified":"2026-10-16T19:18:44.867","url":"https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/app-service/client/orm/app_key.go#L37-L49"}]},{"url":"https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/bff-service/server/http/middleware/auth_openapi.go#L46-L70","tags":["technical-description"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","url":"https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/bff-service/server/http/middleware/auth_openapi.go#L46-L70"},{"source":"nvd","sourceId":"CVE-2026-108856","modified":"2026-10-16T19:18:44.867","url":"https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/bff-service/server/http/middleware/auth_openapi.go#L46-L70"}]},{"url":"https://github.com/UnicomAI/wanwu","tags":["product"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","url":"https://github.com/UnicomAI/wanwu"},{"source":"nvd","sourceId":"CVE-2026-108856","modified":"2026-10-16T19:18:44.867","url":"https://github.com/UnicomAI/wanwu"}]},{"url":"https://www.vulncheck.com/advisories/unicomai-wanwu-through-0.6.5-authorization-bypass-via-v1-appspace-app-key-appkey-minting","tags":["third-party-advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-11T13:26:04.558Z","url":"https://www.vulncheck.com/advisories/unicomai-wanwu-through-0.6.5-authorization-bypass-via-v1-appspace-app-key-appkey-minting"},{"source":"nvd","sourceId":"CVE-2026-108856","modified":"2026-10-16T19:18:44.867","url":"https://www.vulncheck.com/advisories/unicomai-wanwu-through-0.6.5-authorization-bypass-via-v1-appspace-app-key-appkey-minting"}]},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108856-unicomai-wanwu-mcp-key-arbitrary-resource","tags":["exploit"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-13T13:41:14.911Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-13T13:41:14.911Z","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108856-unicomai-wanwu-mcp-key-arbitrary-resource"},{"source":"nvd","sourceId":"CVE-2026-108856","modified":"2026-10-16T19:18:44.867","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108856-unicomai-wanwu-mcp-key-arbitrary-resource"}]},{"source":"euvd","sourceId":"EUVD-2026-97007","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97007","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-97007","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97007"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[]}