Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

published 2026-05-18 5 mo ago modified 2026-07-21 3 mo ago also GHSA-5cvp-p7p4-mcx9 , EUVD-2026-33367

cvss: 6.9; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolve unauthenticated requests as the local development user, making the hosted Inspector and related API surface reachable without credentials. This vulnerability is fixed in 0.11.1.

Patch / fix

fixed in 1 links 1

npm neotoma 0.11.1

github.com/markmhendrickson/neotoma/releases/tag/v0.11.1 release

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago (2026-05-29)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
npm	neotoma	>=0.6.0, <0.11.1	0.11.1

Affected products

markmhendrickson neotoma

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary